Data recovery: RAID 5 with Seagate Cheetah 15K.6

The RAID 5 was restored with four Seagate hard drives as part of our high priority service - the processing was carried out as a priority and around the clock.

15. 3 2018

Approximate reading time: 3 minutes 28 seconds

Initial situation: The RAID 5 server suddenly failed in the morning

The aged server system (about 7 to 8 years old) of a corporate customer had failed. According to the IT company, two of the four SAS hard drives, type ST3300656SS, of the Windows Server 2003 failed in quick succession. According to the person concerned, the IT company had tried overnight to read one of the two defective hard drives, but this was unsuccessful. The entire operation was largely silent and the daily backup was last updated years ago.

Diagnosis and damage evaluation of the four hard drives

The affected managing director from the Hamburg area brought the four hard drives personally to the Attingo laboratory. During the diagnosis, it was quickly established that not only the two hard drives declared as defective had errors. The other two hard drives also had a significant amount of serious sector errors. Accordingly, the preparation of usable raw data copies for the further work process was tedious.  

The RAID 5 was virtually simulated with the raw data copies made. As a result, it was diagnosed that a chkdsk had already run. Various permutations also resulted in either a defective file system or defective data. The parity information was diffuse and there was a lot of evidence of a fatal rebuild.

Windows Server data recovery - RAID 5 restored

In consultation with the IT company regarding the measures initiated, it was found that the employee on site had tried to start a rebuild. One of the failed hard drives was integrated via "force online". However, the rebuild process stopped in the middle, so that attempts were subsequently made to make copies of all hard drives - however, none of the hard drives could be read, even though two data carriers were output as "good" status.

With the new information and the knowledge that a data carrier had already failed months before and that certain file inventories were all defective from a defined point in time, the technicians came to the conclusion that the defective data carrier, which had been inactive for months, had been involved in the failed rebuild. In view of this, our technicians were able to present the best possible data recovery result to the customer. By merging the recovery results from multiple permutations, some of the newer files could even be recovered. The customer considered the almost two months of data loss to be manageable in relation to two years.