Storage Spaces is standard feature in Windows 8 and Windows Server 2012 that was introduced to improve disk space management. With Storage Spaces, you can combine different physical drives, mixing vendors, capacities, connection method, etc., into pools, from which you create virtual disks called Spaces. (For clarity in this document, "Space" refers to a Windows Storage Space.)
Maximum efficiency is achieved by using thin provisioning. Thin provisioning allows creation of Spaces with the sizes larger than the physically-available disk space in the pool.
The main characteristics of a Windows Storage Space are:
- Layout – degree of redundancy (Microsoft calls this resiliency). A Space can be simple, parity, regular mirror, or three-way mirror.
- Filesystem– NTFS or ReFS, the latter available only in Windows Server 2012
- Provisioning – thin or fixed. Windows 8 uses thin provisioning by default. Windows 2012 Server prompts for provisioning type to use when a Space is created.
To understand why it is impossible to unformat a Windows 8 Space, you need to know how a Space is organized and how it works at a physical drive level.
Each drive in a pool is sliced into pieces, or slabs, of 256 MB each. The Storage Spaces driver allocates each slab to a particular Space. When you create a Space, either all the needed slabs are allocated immediately for a fixed-provisioned Space or only some of the slabs are allocated immediately to store Storage Spaces and filesystem metadata for a thin-provisioned Space. The Spaces driver then allocates additional slabs on demand as more storage is needed.
For the sake of simplicity, let’s assume that there is only one physical drive in our pool and we create a single thinly-provisioned Space on the pool. In this example, we do not care about layout type because only a "simple" layout is possible with a single drive.
Once the Space is created, just a few slabs are allocated for it from the pool, namely slab 0 to store Storage Spaces metadata and slab 1 for filesystem metadata. In fact, a few other slabs not shown in the diagram below are also allocated for Storage Spaces’ needs.
Next, as we write data to the space, the Storage Spaces driver allocates more slabs—slab 2, slab 3, slab 4, and slab 5 in the diagram below—to store contents of, say, File 1, File 2, File 3 (the biggest file of, say, about 400 MB), File 4, and File 5.
Original Windows Storage Space layout
Now let’s see what happens when you format the Space. As you can see from the illustration below, slabs 2-5 containing file contents are released to the pool of “available” slabs. So now there is no way to reach them from inside Storage Spaces.
Storage Space After Formatting
If you launch regular data recovery software and specify the Space as a target, it will not be able to recover anything because the Storage Spaces driver will just not provide access to the slabs with data. As far as the Storage Spaces driver is concerned, the data ceased to exist as soon as the slab was relinquished and placed into the “available” pool.
If you specify an underlying physical drive rather than the Space as a target for data recovery software, you still will not get the data. Because even in the case of a Space on a single drive, the Space could be fragmented at the slab level! The more you used the Space before formatting, the more chance the space is fragmented.
Data recovery software can only read data from a drive sequentially and therefore cannot take into account space fragmentation. The only thing you can do in this case is to try to recover the Storage Spaces configuration, that is, to determine which slabs belong to which Spaces and in what order. This is not a task for regular data recovery software!
A similar situation occurs when you delete files larger than slab size (256 MB). In this case, as far as the Storage Spaces driver is concerned, the slabs are no longer needed and are immediately brought back to the pool of “available” slabs. In fact, this is very similar to how the TRIM command on an SSD works.
As you can see from the illustration below, after deleting file 2, file 3, and file 4, regular data recovery software can only bring back part 1 of the File 2. And it can do this only because it is stored in slab 2 together with file 1.
What happens when you delete data from a thinly provisioned storage space
If you are dealing with a fixed-provisioned Space, forget everything I said. Since there is no dynamic slab allocation, unformat and undelete work fine. But the problem in Windows 8 is that all Spaces are thinly-provisioned. And now you know why you can kiss your data goodbye if a Win 8 Storage Space goes belly-up and you don’t have a backup.
Elena Pakhomova does both marketing and development for data recovery software company ReclaiMe.com.