Retrieve Critical Files From Your RAID
We are the UK experts in rescuing data from failed RAIDs and will retrieve files and folders from your broken array professionally and promptly, minimising your company’s downtime.
We retrieve critical files from all types of RAID arrays including:
- level 0 (striped),
- level 1 (mirrored),
- level 5 (distributed parity)
as well as the less common variants level 4 (with one dedicated parity disk), 6 and 10 and others.
We cover all operating systems, including:
- the major families of Microsoft Windows Server (including Exchange and .edb databases),
- Apple Mac OS X Server,
- Linux servers and workstations.
Our extensive knowledge of file systems includes NTFS, HFS+, ext2, ext3, ext4, XFS and many older file systems that continue to provide faithful service. Bottom line: we can help you get your business back on its feet regardless of the technology you have chosen.
State-of-the-Art Array Recovery Systems
Servers are integral to your organisation’s computing infrastructure. Our heavy investment in developing state-of-the-art recovery systems ensures the best possible recovery from your company’s unexpected data loss.
We also recover files from defective NAS devices (Network Attached Storage), across the range from two to eight hard disks.
At Tierra all services are provided by our own experts, with many years of experience in specialist storage arrays.
If you want a quick refresher class in the basics and the terminology, take a look at our Guide to RAID.
Get started right away.
Our depth of experience provides you with fast effective turnaround time.
We only require your hard disks, not your controller, so while you are waiting for your vital files you can re-establish your working server ready for data population.
We can arrange to collect your disks, saving you time and money.
RAID recovery from £660 (ex VAT)
Speak to a Recovery Specialist
Call 0845 094 0027 now and speak to an experienced specialist engineer from the first call. We’ll walk you through the scenarios and launch the rescue process.
Expert Analysis as Standard
Get your storage array system analysed by the experts. Tierra has an outstanding record of recovery from systems suffering failure.
We know that you are likely to be under severe time pressure with your failed system, so we make sure you are kept up-to-date while we follow best practice in preserving, analysing and retrieving the lost files and folders, across all file systems.
Our professional analysis of your RAID system will quickly identify critical files and folders. Tierra use forensic techniques, cloning each hard disk and processing the total array as image files.
If necessary, we will reassemble any inaccessible member disks mechanical parts with donor components to enable raw sector reading. Commercial file recovery software will simply not help you in such circumstances – there is no substitute for hands-on experience.
After scraping the raw sectors the array images are analysed to identify corruptions to both true user content and parity blocks and work begins to destripe, reconstruct and repair the file system. Tierra’s proprietary software then extracts files and folders from the image files.
Call and speak to a specialist engineer on 0845 094 0027 and get expert help from the very first call. They will talk you through the process and give you a fixed price for your recovery.
Emergency Service for Short Timescales
In urgent situations ask for Tierra’s Emergency Service. Experienced engineers will work around the clock to complete both the analysis and the recovery. This can save several elapsed days in round-trip disaster recovery time. Critical files can be sent by email or made available as secure downloads from the Tierra website without waiting for the final full file-set.
Call 0845 094 0027 now for a fixed price for your recovery.
Case Study – Rescuing a Failed Buffalo TeraStation
This is a typical example of successful rescue engagement.
TeraStation RAID5 Failure:
We received a call from an anxious client with a failed Buffalo TeraStation.
This TeraStation was composed of four 1TB S-ATA hard disks in a RAID 5 configuration (therefore offering 3TB of storage array capacity). Originally array member 4 had failed and the client had then replaced it with a new hard disk. The TeraStation had then begun to re-build the volume and the client had left the unit to complete this task. On return the next morning it was found that the TeraStation was now reporting that array member 2 had failed. This too was replaced with a new hard disk but the TeraStation did not proceed any further.
We arranged for immediate collection of the four original and two replacement hard disks.
The TeraStation Recovery-Step 1:
We received hardware with the following technical specifications:
- Original drives #1 to 4: Samsung HD103UJ all manufactured on the same date
- Replacement unit for #4: Samsung HD103UJ (manufactured approximately 3 months after the originals)
- Replacement unit for #2: Samsung HD103SJ (manufactured some years after the original hard disks)
The hard disks arrived in our lab and, as always, step one was to forensically clone all six to fresh hard disks. This elaborate process allows us to work without endangering the client data. As is usually the case with failed RAIDs the member drives did not clone smoothly. Two of the original four drives were suffering from bad sectors. This is a common failure, especially among older and well used units. Over time and with more and more usage the ability of the platter to maintain the electromagnetic signal that is your data wanes (just as a permanent magnet over time will slowly lose its magnetism).
All platter-based storage units have some bad sectors and will develop more over their lifetime, they have a built-in store of spare sectors which they will allocate as bad sectors develop. However this pool of spare sectors is not infinite and once used-up the total number of usable sectors on the drive will start to decline. This can be more of a problem than may initially appear, a single unreadable sector if located at an unfortunate part of the hard disk can prevent the operating system from starting at all.
It may seem surprising that two array members within a set of 4 should fail almost simultaneously but perhaps it shouldn’t. It is most likely that the harddrives will have been produced in the same factory, on the same date and have spent their operational lifetime in the same operating conditions. Consequently the circumstances that cause one hard drive to fail will very likely affect the others in a similar manner.
The results of the cloning work were as follows:
- Original Drive #1- cloned with exception of a single sector.
- Original #2- ultimately proved too damaged to clone any significant amount.
- Original #3- cloned with the exception of a single continuous sequence of 8 sectors.
- Original #4- cloned with the exception of a total of 16 sectors spread across 5 areas of the hard disk.
- Replacement for #4- cloned without error.
- Replacement for #2- cloned without error.
To put these numbers in context a 1TB hard disk is typically composed of 1,953,525,168 sectors. However in this as in other matters, location is everything, even a single failed sector can prove catastrophic to retrieval if it occurs in the wrong place.
With the array members cloned the originals could be put to one side and would not need to be touched again.
The TeraStation Recovery– Step 2:
The next step was to try to rebuild the 3TB volume. This was a RAID 5 recovery task, so we needed a minimum of 3 of the 4 array members to be accessible in order to retrieve the user data.
In this instance there were a couple of complications:
- We knew that we did not have original drive #2 it was too badly damaged to clone.
- The client had replaced original #4 when the first failure occurred; at this point the TeraStation began to re-build the volume. We do not know how far it got before original #2 failed and the re-build stopped. Consequently we did not know which combination of our clones would provide the best approach to obtaining all files intact.
The client stated that when original #2 was replaced the Terastation did not appear to make any attempt to re-build the volume. The next logical step was to examine the clone of the replacement #2, it was in fact found to be completely empty and so could be eliminated from any further consideration.
This now left us with: Original drives #1 and #3 and two clones for #4 (the original and replacement).
In order to proceed we needed to decide which of the two #4 clones would be the better to use with #1 and #3 in order to attempt to re-build the storage volume.
A hex editor examination of both of the #4 clones was inconclusive; both had significant amounts of data. The way forward would be to rebuild the 3TB storage volume twice, once with each of the #4 clones and compare the results.
The TeraStation Recovery– Step 3:
The next task was to deduce member order, striping size and parity arrangement in use for this RAID5 configuration (of these, stripe size is the easiest to determine and parity arrangement the hardest). With storage arrays in general, while the array slots are numbered sequentially, this pattern is not necessarily reflected internally.
This was done again using a hex editor to determine how the data had been split across the 3 diskdrives. Once this had been determined then the next task was to re-build the 3TB volume. This would be done twice. First using the original #4 and then replacing it with the replacement for #4.
The file system in use was XFS, this is a widely used file system for NAS devices. Interestingly both re-build attempts demonstrated a complete looking file tree. Full directory structure and file names were present whichever of the #4 clones had been used. However when the data was sampled by selectively pulling files and confirming that they were intact it was found that original #4 did not return any corrupted files whereas less than 1 in 3 of the files sampled from the 3TB volume re-built using the replacement #4 clone were intact.
Step 4 – All Critical Data Recovered:
We now concentrated on the array rebuild using the original drives #1, #3 and #4. There proved to be small amount of file system damage resulting in the loss of a handful of files but ultimately a success rate in excess of 99% for the original client data, including (crucially) all critical files. The successful rescue was immediately supplied on an encrypted external storage unit to a very relieved customer.
To get started, contact us using the short form on the left or email us or simply call us now on 0845 094 0027 or 0131 663 4137. Our friendly experts are waiting for your call.