Data Recovery Case Study: Dell Power Edge

Patient:

Dell Power Edge 1950 raid with 4 SCSI hard drives in a raid configuration.

Reported Fault:

Failed RAID array

We were contacted by a company who were suffering from an issue with their server. The company’s I.T department had tried to make repairs but had failed. The company arranged for the server to be transported to our laboratory to allow us to work on the failed RAID server. We offered them our ‘no fix- no fee’ analysis of the RAID (redundant array of inexpensive disks) system to see if we could recover the data.

The system was configured into a RAID 5 (block-level striping with distributed parity) which distributes parity along with the data and requires all drives but one to be present to operate. The array is not destroyed by a single drive failure. Upon drive failure, any subsequent reads can be calculated from the distributed parity such that the drive failure is masked from the end user. However, a single drive failure results in reduced performance of the entire array until the failed drive has been replaced and the associated data rebuilt. In this case, the first drive had failed some time ago and had been overlooked, and thus when the system suffered a second fault the redundancy of the RAID system could not function and the system refused to work.

The first failed drive had not been used for a long time, therefore, no data had been written to it for a while so it was discarded from the recovery attempt. We then turned our attention to the second of the failed drive which had developed a number of bad sectors over-time. These sectors however had not failed completely, which enabled us, using our specialist equipment, to control the internal workings and moving parts of the hard disk drive. We connected the failed drive to one of our hard drive diagnostic machines which allows us to control how the hard drive functions and copied it bit for bit to a healthy working replacement drive.

However, there was still now what we call logical damage which is slightly corrupted information that we had to deal with in order to gain access to the data. We connected the three now working drives to a special unit and using data recovery software programmed in the RAID control settings to access the data in the correct order and stripe size. Once this was done and we had access to the data we copied the information off to a fresh working hard drive to have a portable copy of the data and presented this to our clients upon receipt of payment for the work carried out.