Increasing The Level Of Difficulty: RAID Recovery
More and more enthusiast users approach Kroll Ontrack with destroyed RAID arrays. Generally, data recovery from such a RAID array is possible, but keep in mind that the effort increases disproportionately. First of all, data has to be copied from a RAID drive onto a server, and the data set has to be put back together. The distribution of data into smaller blocks across one or more drives makes RAID 0 the worst possible type to recover. Increasing performance doesn't necessarily do your data any good here! If a drive is completely defective, only small files, which ended up on only one of the RAID drives (despite the RAID stripe set), can be recovered (at 64 kB stripe size or smaller). RAID 5 offers parity data, which can be used for recovery as well.
RAID data configuration is almost always proprietary, since all RAID manufacturers set up the internals of their arrays in different ways. However, they do not disclose this information, so recovering from a RAID array failure requires years of experience. Where does one find parity bits of a RAID 5, before or after the payload? Will the arrangement of data and parity stay the same or will it cycle? This knowledge is what you are paying for.
Instead of accessing drives on a controller level, the file system level (most likely NTFS) is used, as logical drives will provide the basis for working on a RAID image. This allows the recovery specialist to put together bits and bytes after a successful recovery using special software. Kroll Ontrack can illustrate data structure visually (see above). The recovery of known data formats is an important approach in order to reach towards a complete data recovery. Take a JPEG file for example - will you be able to recognize a picture after recovery? Or will you be able to open Word.exe, which is found on almost every office system? The selected file should be as large as possible, so it was distributed across all drives and you can know for sure that its recovery was successful.
If two drives of a RAID 5 are flawed, but enough data can be saved from the malfunctioning data mediums, Kroll Ontrack is usually able to recover this data. Two dead hard drives in a RAID 5 are more likely to be restored than two single platters, since RAID still provides parity data.
