A Complete Guide for RAID 5 Array Data Recovery

Overview

RAID 5 is a storage solution that balances storage performance, data security and storage cost which can be understood as a compromise between RAID 0 and RAID 1. RAID 5 supports providing data security for the system, but the degree of security is lower than that of “Mirror” and the utilization rate of disk space is higher than that of “Mirror”.Besides, the data reading speed of RAID 5 is similar to that of RAID 0. Because there is one more parity check information, the speed of writing data for RAID 5 array is slower than that of a single disk. Meanwhile, since multiple data correspond to one parity check information, the disk space utilization rate of RAID 5 is higher than that of RAID 1 and the storage cost is relatively low. All things considered, it is a disk array solution which is widely used at present.

The data and corresponding parity information of RAID 5 array are stored on each disk that makes up RAID 5, and the parity information and corresponding data are stored on different disks, so when single disk of RAID 5 is damaged, the data integrity will not be influenced to guarantee the data security. When the damaged disk is replaced, RAID 5 will automatically use the remaining parity information to reconstruct the data on this disk to maintain the high reliability of RAID 5.

Note:  All disks in the RAID 5 array must have the same capacity. If the capacities are different, each disk shall adopt the smallest one. It is best to have the same hard disk speed, otherwise the performance will be affected.

RAID5 Array Data Recovery

The distribution of data in the RAID 5 array is similar to that of RAID 0, which is distributed to each hard disk. Different from RAID 0, there is always one stripe in each stripe group in RAID-5 that is a parity block, for example, “Dp, Cp, Bp, Ap” in the figure is a parity block.

RAID 5 supports normal data access when a disk is offline. But if two or more hard disks are offline simultaneously, or the RAID information is wrong, the array will fail, and the data needs to be reconstructed.

When reconstructing RAID data, it is necessary to RAID the physical disk first and analyze it as a single disk. Taking the four physical disks in the figure as an example, splicing the data in the four physical disks in the order of ” A1 , A2 , A3 , B1 , B2 , B3 , C1 , C2 …”. After splicing, it is the complete data in the RAID 5 logical disk.

As for RAID 5 array, there is parity information in each physical disk,  so RAID 5 analysis requires one more factor than RAID 0, which is the position and direction of the check block. In addition, the direction of the data block in RAID 5 is different, divided into asynchronous and synchronous, that is to say, there are four important factors in RAID 5 parametric analysis:

1. The first factor is the size of each stripe, which means the number of sectors the above data blocks “A1, A2, B1, B2…” occupied.
2. The second factor is the arrangement order of the hard disks, also known as the disk sequence.
3. The third factor is the loop direction of the parity block.
4. The fourth factor is the direction of the data block.

There are usually two common solutions for RAID 5 data recovery, one is the automatic analysis by DRS Data Recovery System from SalvationDATA, the other is manual analysis by winhex. This article will mainly explain the automatic analysis solution.

 

Case Study

• Description: There is a disk array module failure on the server involved in the case, the normal disk sequence is known, and it needs to be analyzed now to recovery array data.

Inspection material: 1.img  2.img  3.img

Tool: DRS Data Recovery System

Step 1. Open the software, select “File Recovery-RAID” and then add image files.

Step 2. After image files are added, analyze the array parameters.

After adding the image files, the investigators can manually set the known configuration parameters in the red frame area in the figure.

If you do not know the parameters, please check the “Auto” as shown in the figure, and click “Start” to complete the automatic analysis of disk array parameters.

Click “OK”, then you can see the disk array parameters after automatic analysis in the figure.

Step 3. After the automatic reconstruction is successful, click “OK”, the reconstructd disk array, partition and related information will be appeared .

Step 4. Select Partition – “Quick Scan” – “Scan”, enter the scan result to view the data and verify whether the disk array reconstruction succeeded.

• Find some large files from the scan result (at least larger than the stripe size, the bigger the better). If it can be previewed normally or opened normally after saving, it means that the reconstructionis successful.
• If the following situations appear, it may be that the current disk array reconstructionis unsuccessful, needs reanalysis.

1. The files cannot be opened normally.
2. The files cannot be previewed normally.
3. The content missing exists when opening the files.

After the disk array reconstruction is successful, the investigators can select the required files to save to local computer.

So far, the automatic reconstruction of the disk array by DRS Data Recovery System is completed.

Cautions

• When fixing the data of server array, if the server is not faulty, it can be fixed without dismantling the machine.
• If the hard disk in the server array needs to be removed to perform the separate image operation, please remember the sequence number of the hard disk when taking it out.Otherwise, the later analysis will be more complicated.
• The parameter information of some disk arrays will be written to the head or tail of the sectors of a single hard disk. The sector space can be checked through the underlying hecadecimal mechanisms. If the relevant parameter information can be obtained, the array reconstruction will be more complicated.
• The RAID 5  array mechanism allows one disk to be lost, but if more than two hard disks are damaged, the data will be severely If one disk is lost, the method of filling in with an empty disk can be adopted, as shown in the figure below.

• The array storage of some servers is separated by adopting a separate array host, so It is necessary to carefully check the storage structure of the server during the on-site investigation.
• Except for the four factors mentioned above, it is also necessary to pay attention to the manufacturer type of the array, the starting sector (the header will retain some sectors to store the array information), hot spare disk, etc.