The Problem
A customer contacted a data recovery service and asked to recover data from a failed RAID array. According to the customer, the array was a RAID 1 of two disks.
A quick check in the data recovery lab revealed that the data on the disks differed noticeably. This indicated that the array was probably not RAID 1, since the disks in a RAID 1 must contain the same data. Since it is known that RAID 1 arrays are often confused with RAID 0, data recovery specialists tried to determine parameters for a RAID 0 array.
RAID recovery software suggested a RAID 0 configuration with a block size of 1 MB. However, recovery using these parameters did not produce valid data. So the data recovery service contacted our tech support, to see if we could help.
RAID 0, 5, 6, and 10 have block sizes that are much smaller (a million times smaller) than the size of the hard drive they reside on. RAID 0, for example, typically uses block sizes between 32 and 256 KB.
RAID 1 and JBOD, on the other hand, are not divided into blocks. Therefore, their block size should be infinitely large. Since our RAID recovery software found a 1 MB block size (the maximum allowed in the program), this led to the conclusion that we were dealing with either RAID 1 or JBOD. But the different contents of the two drives voted against RAID 1.
The solution
We scanned each disk of the array separately using regular data recovery software and then compared the results. It was found that both disks contained similar data. But one of the disks also contained older, different data.
We guessed that we were dealing with a RAID 1 array that had failed long ago and had not been synchronized since. This situation can happen quite often with nVidia controllers and less often with Promise controllers and Windows software RAID (if you do not check the Disk Management utility periodically).
In this case, we were lucky that the filesystem was ext3. It is one of the few filesystems that usually recovers well. To recover ext3, you don’t need to assemble two parts of JBOD into a single array – it is enough to just scan the disks separately, copy the files and then merge the copies. However, files having content and metadata on different disks will be lost.
In the end, the data recovery service should have tried to recover RAID 1, despite the different content on each drive. They would have eventually figured this out. We were just able to respond to their query faster than them trying the recovery on their own.
Elena Pakhomova does both marketing and development for data recovery software company ReclaiMe.com.