NAS and SAN Technology

Network Attach Storage (NAS) and Storage Area Network (SAN) units will usually contain multiple hard disks configured as a RAID array. These are attached to the network and present storage space for use by other computers on the network.

Such units were at one time the preserve of the enterprise level market, mostly used by large companies and data centres. With the price of storage dropping over the last 10 years, NAS units have become more common across sectors, with many being used in the home, often as a media server rather than using a computer to act as the server. It is important that these units are configured correctly and their health monitored to avoid problems which can only be resolved through data recovery.

Network Attached Storage

A NAS system once configured is expected to operate with little or no intervention and act as central file storage area, which can be used by any computer attached to the network whatever the operating system, such as Windows, OSX, Linux, BSD etc. These range from simple systems, which allow any user on the network to access the data, through to multiuser systems with storage quotas, to cater for all market levels.

Many of the most recent NAS systems can be configured to automatically backup data to a cloud server. These provide an efficient system for centrally storing data, without the need to share data from an individual computer, which can cause complications, especially when that system needs rebooting. A NAS is intended to act as a continually available file server.

Storage Area Network

A SAN system, usually only seen at enterprise level, is most prevalent in data centres. These are configured to present disk space to a specific machine as though it were a hard disk directly attached to that machine. This is particularly useful when multiple rack mounted servers are being used, where installing additional hard disks would be inefficient and complicate the process of ensuring no data is lost.

These are most likely to be attached to a 10Gbe network in order to provide the kinds of data transfer required. A SAN system will usually contain data from multiple servers, with no knowledge of the underlying file system being used. These are usually meticulously maintained, often with fail over servers in place, making data recovery due to failure very rare.

Correct Configuration and Data Recovery

For a NAS system it is important that when they are configured, that the RAID level used is appropriate for providing redundancy. It is tempting to use a RAID 0 striped configuration as it provides the most efficient use of disk space, but this increases the risk of data loss, as the failure of any disk will cause the NAS to fail. Less efficient configurations are recommended from the most secure RAID 1 mirroring through to RAID 5 which provides a good compromise between data redundancy and disk usage.

At DiskEng we have extensive experience of recovering data from both NAS and SAN systems, with a high level of success. It is usually only multiple catastrophic disk failures or a misguided attempt at recovering the data which can lead to severe or even total data loss.

Why Use RAID 1 Array

RAID 1 often called a mirrored array, utilises a pair of hard disk drives to provide 100 percent data redundancy by ensuring both drives contain the same data, known as mirroring. Despite hard disk drive prices being low, it is rarely seen outside of enterprise solutions, often used for high dependency systems, which are required to run 24/7.

Mirrored arrays are being seen ever more frequently for data recovery, which is because of a couple of factors discussed below. The DiskEng data recovery specialists have extensive experience in recovering data from mirrored RAID 1 systems most usually required following the failure of both disks in the array.

Data Safety Essential

The second disk stores a mirror copy of the data which ensures the highest level of data redundancy possible with a RAID array. Although it halves the potential storage capacity, using a RAID 1 array has little or no drawbacks over using a single disk, despite the requirement to write the data to two drives. Data transfer speeds when reading data may in some cases may see a small increase.

The price per gigabyte of data has dropped rapidly, making the use of RAID 1 architecture more attractive, a significant reason for a corresponding increase in data recovery requirements. Using this type of RAID in high dependency servers may be highly beneficial, but a backup plan should still be implemented in order to guard against any potential failure.

RAID 1 Re-mirror

A RAID array will remain operational following the failure of a single disk, at which point it will run in degraded mode. When a hard disk fails should always be replaced with a new one as soon as practicable, so that the data from the working drive can be re-mirrored.

Data transfer speeds have increased considerably, but at the same time overall capacities of hard disk drives has correspondingly increased. This means that re-mirroring will take a considerable length of time, at which point the data is vulnerable. If you source both hard disks from the same supplier at the same time for use in a RAID 1 array, the possibility of the second drive failing shortly after the first is significantly high. Due to the significantly increased time taken when re-mirroring modern hard disks we are starting to see a rise in the number of RAID 1 arrays which require data recovery.

Data Recovery RAID 1

If your RAID 1 array suffers a failure, which usually occurs during the re-mirroring process, it is important that you do not panic. It is important that both of the original hard disk drives used in the RAID 1 array are sent for professional data recovery. If the failure became apparent during re-mirroring it may be beneficial to supply the new hard disk drive onto which the data was being copied, as important data, vital for achieving a successful data recovery may be contained on the drive.

If the hard disk drive which initially failed is not too far out of date, it can be used by our data recovery specialists to rebuild a fully working array in the event of encountering bad sectors on the other drive. Data loss is only likely to happen in the event of both drives containing the same unreadable bad sector or when the failure of one drive is not acted upon immediately.

Operating System Crash or Errors

A system crash or random application errors are an all too common occurrence, the root cause of which can be due to one more differing problems. Such problems can range from any number of hardware faults through to software and logical errors, affecting drivers or the file systems. Repeated attempts at rebooting the computer are unlikely to fix the problem unless you can find the real cause of the problem. Should the computer reboot it you may be lucky, but there is a good chance that the problem may reoccur due to an underlying issue.

If your computer is crashing regularly or unexpected software errors start to occur, it is important to take action before the safety of your data is put at risk. Repeatedly rebooting a computer which is suffering from crashes could very likely risk make the problem worse, and make data recovery a more difficult process.

Hardware Problems

A hard disk drive problem is the most likely to put your data at risk, although a failure of a memory module could have the potential to cause corruption. Determining the cause of a hardware issue is important, as some could lead to further failure, such as the failure of a cooling fan, which may lead to a reboot due to the computer becoming too hot.

If the hard disk drive is failing, it is important to ensure that your data is backed up before data recovery is required. Although the occasional computer crash can happen with no problems occurring, it is easy to become complacent, such that an increase in crashes is not seen as unusual.

Software and Logical Data Corruption

Some crashes may be caused by driver errors, software corruption or file system damage. Driver issues and software corruption will most likely be inconveniences, which should be resolvable by their reinstallation. Some file system damage may be the consequence of a sudden reboot, through a power failure or a system error, which is usually fixed without any problems when the file system is mounted.

File system damage caused by unreadable bad sectors or malware damage in many cases cannot be easily fixed, and often an attempt to fix it may cause further corruption of the file system. Most users will install anti-virus software, which will usually provide protection, but does not guarantee the safety of your data.

Crashes and Data Recovery

If your problem appears to be due to either malware problems or a failure of the hard disk drive, it is important to power your system down and seek professional help. In such a case any attempt to reboot the system, even if it succeeds could be causing further damage, which could cause loss of data.

In most cases data recovery should be possible as damage to the file system is usually only minor. However if the corruption becomes too severe the level of data recovery success will be affected, as important data structures and even file data may be too damaged. All computer systems and file systems are at risk when this occurs, so it is important to act before it is too late.

Failure After Power Outage

Failure of the power supply or a power cut can result in damage to electronic components in a computer. When the power fails there is a small chance of a power surge occurring and also when power is restored.

If a failure occurs it is usually just a matter of inconvenience waiting for the damaged component to be easily replaced. However, if the hard disk drive has failed, it is not a simple case of replacing the drive and being back up and running. If the hard disk contains important data, it should be sent for data recovery, as it requires professional expertise to gain access to the files.

Power Surge Damage

Electronic components are only capable of surviving voltage and current levels within certain tolerances. A power surge can lead to a situation where these levels are exceeded, which can cause damage resulting in a failure of the component.

Any single power surge may not necessarily result in an instant failure, but as with damage caused by excessive temperatures, it is cumulative. The most common component to fail is the power regulator, but any other can be damaged. A failure of the firmware chip or maintenance area would make the process of data recovery much more complicated.

Controller Board Rebuild

In some cases it is possible to repair the damaged component or components, which allows the data recovery engineers to secure a sector-by-sector image of the hard disk drive. If the damage is severe, it will require a donor drive to be used, the controller board from which allows an image to be secured.

This is a process which should only be undertaken by a qualified data recovery engineer using specialist knowledge and equipment. Any attempt by a home user at replacing components or using a donor board risk causing further damage which was not present when the drive failed.

Power Surge Data Recovery and Protection

Our success for recovering files from hard disks which have failed due a power surge are very high, providing no risks have been taken which may have caused damage through do-it-yourself data recovery attempts. If the drive was operational at the time the power surge occurred it is possible for there to be some data which was not committed to disk, any such damage is usually very small, often only causing damage to temporary files.

Surge protectors typically are cheap to buy, but not all are good at eliminating the issue from affecting your computer. A more expensive option, but one which should provide fullest protection is to install an uninterruptible power supply (UPS) which will also allow the computer to undertake a controlled shutdown in the event of a power outage. It is important that any UPS is regularly tested, as a non-working UPS may be as bad as having no protection at all.

Deleted or Partition Expansion Failure

With ever larger hard disk drives available expanding the storage space in a computer is now very commonplace. This includes adding additional drives or swapping drives in a RAID for larger ones through rebuilding the data at each step. The temptation after installing extra storage space is to rearrange data and even change the partitions which existed on other drives.

Caution must be exercised when rearranging the data partitions, as one simple mistake may or misfortune could result in data being lost. Understanding exactly which disks contain what data before you start is important if you are going to delete any partitions. Extending or growing partitions, while a common practise can in some cases cause a volume to become corrupted, also potentially losing data. In both cases, best option is not to run any tools or attempt a recovery yourself, but call in data recovery specialists, such as DiskEng, who can advise you on the best course of action.

Deleted Data Volume

Deleting the wrong data volume is an all too common scenario, but it need not cause a total loss of the files held on that partition. When a data volume or partition is deleted, entries held at the start of the hard disk are clear, allowing that space to be reallocated as free space for new partitions to be created. The data volume is not altered by this action, so it is important not to panic and make a mistake.

In some cases deleting a partition may result in an operating system message about an unused disk, which should be reformatted. Be absolutely sure after deleting a volume that creating a new data volume on this disk is what you require. Reformatting a data volume will destroy important metadata structures from the previous partition, which with some file systems may lead to a total loss or data, or a data trawl as the only viable option.

File systems such as NTFS and XFS can produce excellent data recovery results after the volume has been reformatted, as a few metadata entries are overwritten during the process. Any new data written to a reformatted volume will reduce number of files which can be successfully recovered from the original file system.

Expanding Data Partition Failure

Deleting a volume from a disk and then expanding or growing another partition to use that space is now a common procedure. There are many utilities designed to perform this task, which are robust and efficient. However, misfortunate such as a power failure, system crash or file system corruption of the original volume could lead to situation where this process fails, resulting in corruption, whereby the volume can’t be mounted by the operating system.

If this happens, it is essential not to run any tools to fix the problem, as they may lead to even further corruption for the data, which may result in severe data loss. Expanding a volume is usually a fairly simple process, which requires a few key metadata structures to be altered. If this process fails, it is rare that it will cause corruption severe enough to render the data unrecoverable. The wisest choice is therefore to contact a data recovery company, who have the expertise to recover your data files.

RAID “Write Hole” Phenomenon

If a power failure occurs during the write process to a RAID, the “write hole” phenomenon can be the result. This can happen in any RAID array including RAID 1, RAID 5 and RAID 6 whereby it’s impossible to determine which data blocks or parity information was not written to disk.

When this occurs it is undetectable and may go unnoticed resulting in problems at a later time. Although this situation is fairly rare, it can lead to serious problems, especially if a data recovery is required. This highlights why it is important not to become complacent, and think “I have a RAID, so I don’t need a backup” or you could suffer serious data loss.

Data Not Written

As already described, when a power failure occurs it is possible for some data not to be written to all the disks in a RAID array. With modern journaling file systems a power failure is not usually a problem, as any failed writes are still stored in the journal, but a RAID system may be performing many read/write tasks in parallel, which may lead to unusual timing issues.

If the data that was not written is a data block, when the file system is mounted, the journaling may well correct any issue, but any failure to write the parity stripe could cause a serious issue and go undetected until that parity data is required.

Resynchronisation Issues

Take a RAID 1 mirrored pair as an example, whereby data is written to a pair of disks, and a discrepancy is detected between them after a power failure, it is almost impossible to know which disk holds the correct version of that data. In a RAID containing calculated parity information, the same is also true when the parity data does not match the data blocks stored in a stripe.

This means that running a resynchronisation could consolidate the incorrect data as part of the RAID, leading to either corruption of file system data structures or file contents. Scheduled resynchronisation is recommended as part of RAID maintenance, but is not guaranteed to fix this problem. The act of writing data to the RAID will cause the parity in that particular data slice to be resynchronised.

Data Recovery and UPS

Installing an uninterruptible power supply (UPS) for a system running a RAID is the best choice when it comes to avoiding the “write hole” phenomenon. By doing this a controlled shutdown of the server can take place, avoiding the issue of file system corruption.

During data recovery from RAID systems, it is almost impossible to determine which disks hold the correct data if a “write hole” is detected. Through manual intervention it may be possible to resolve some of these issues, but others may be impossible to determine, so it’s important to reduce the risks of suffering “write hole” damage.

Virus/Malware/Spyware on Computer

Even before the internet was established, the problem of computer viruses was a big issue, with distribution generally via infected diskettes. Since the internet, the problem has increased to the extent that the first software most users install is a security suite, but this does not guarantee that you will be safe. A virus is self-replicating and will hook itself onto files and executables, although the term is now being superseded by the word malware (malicious software).

Malware and spyware are insidious forms of software which can be installed on your machine, with malicious intent, to either steal confidential information, such as passwords and credit card data, or hi-jack your browser, or even disable your anti-virus. We commonly see malware and spyware on hard drives which arrive for data recovery, although these are not always the reason for the data recovery being required.

You Data and Information are at Risk

There are many types of malware, some are fairly harmless but irritating, but a large number are extremely malicious, causing file content to be rewritten, or the important system structures to be overwritten on your hard drive. It is therefore important to detect if your system has been compromised, otherwise your data may be systematically destroyed if the virus has a payload which overwrites file contents.

Spyware is software which attempts to steal important information, in particular on-line transactions, including usernames, password and credit-card details. There are some forms of malware called ransomware, reporting a supposed legal transgression which forces you to pay a fee on-line in order to continue using your computer. Scareware claims an intrusion or problem has been detected on your computer, attempting to scare you into downloading and buying some software which purports fix the problem.

Removing Virus, Malware etc.

Assuming you haven’t fallen into the traps which can occur, you will want to remove the malicious software. This is not always easy, especially if it has hi-jacked your security software, or internet browser, whereby the pages you visit are not from the authentic website.

There are numerous programs for removing different malware and spyware, which very often require a combination of applications to remove them. This process can be lengthy, and is not even guaranteed to succeed, meaning that if you have a destructive malware program installed, the integrity of you data may be further compromised. The sure, but very drastic method is to reinstall the operating system, but in many cases, this is the faster and safer method. The most important step though, is to secure your important data, for which data recovery could be your best option.

Data Recovery Implications

The implications of malware on data recovery can range from almost no impact, through damaged files, to severe corruption of the file system. We have received many hard drives for data recovery, where the partition table, or file system structures have been overwritten. This requires specialist knowledge of the data structures, which have to be replicated in the virtual volume created during the data recovery process. As long as the data files have not been damaged, the results of data recovery from a malware damaged drive are generally excellent.

Flood or Water Damaged Computer

There are many reasons your computer may suffer water or fluid damage. This can range from flooding, burst pipes, overflowing water tanks, or even the accidental spillage of liquid from a container knocked over the computer, to suggest a few scenarios.

If the hard disk drive gets wet, it is important that you take the correct steps, to avoid doing irreparable damage to the data stored on the drive. By following the steps below, you enhance the chances of a successful data recovery from a water damaged hard drive.

Do NOT Power the Computer Up

If water has infiltrated your hard disk drive, it is important not to power your computer up, even if you have dried all the components. Water will remain inside the drive, and affect the operation of all the components inside, and if it does start to spin up and move the read/write heads, it may lead to damage to the surface of the platters. The read/write heads can become stuck to the platters, with the water and any contaminants acting like glue.

Water is also a conductor, and even if you believe you’ve dried it all up, it may still cause a short circuit, which can lead to components being damaged, and in serious cases, even blowing up, sometimes with a violent explosion. The water can also leave contaminants behind, which may also cause problems to the electronics.

Do NOT Dry Out Your Hard Disk Drive

This may seem counter-intuitive, but once a hard disk drive has become wet, it is advisable not to allow it to dry out. The water that has entered the drive will almost certainly contain contaminants which, if allowed to dry will form a residue on the platters, which can have a corrosive effect caused by oxidation.

If any residue is allowed to dry in situ, even if it does not cause corrosion, may be very difficult to remove later without causing damage to the surface of the platters. Any debris must be removed before any data recovery can be attempted, as it would otherwise impact with the read/write heads leading to severe crash damage.

Keep Your Hard Disk Drive Wet

Ideally the hard disk drive should be placed into a sealed container to keep it wet. This stops the components of the hard disk drive corroding, and once received at the data recovery laboratory, the correct cleaning procedures can be undertaken, to minimise the damage to the surface of the platters.

Water Damage Data Recovery

By following the steps above, you give us the best chance of a successful data recovery from your hard disk drive. Our data recovery specialists have been trained to follow the best procedures for cleaning you hard drive, prior to attempting to read the data from it.

These guidelines still hold true for any SSD, unless they are explicitly designed to be rugged and waterproof. Even for a waterproof SSD, it is important that the connectors and the computer it is connected to are properly cleaned and dried. Failure to do so could result in damage to the SSD drive.

RAID 5 vs RAID 10

Redundant Array of Independent Disks (RAID) offers many benefits, from data read/write speed increase through to data redundancy. Each RAID level is a compromise between data security, hardware requirements and read/write speeds.

Your budget will be a big factor in determining which RAID level is most appropriate, but if there is no constraint, data security should be high on the list. No matter which RAID level is selected, it is important not to fall into the trap of thinking, ”I have a RAID, so I don’t need a backup,” otherwise your future will almost certainly include RAID data recovery.

RAID 10 Provides 100% Redundancy

RAID 10 stripes data across a set of mirrored pairs, and therefore requires double the number of drives, for the given capacity required. This provides full redundancy, but as with any RAID system, the failure of one drive could be closely followed another. If a mirrored pair fails at the same time, it will bring the RAID to a halt, so although this gives the best data security, there is still some risk.

RAID 10 can also in many instances provide faster read and write times, as there is no need to calculate parity. RAID 10 hardware is often set up to take the data read from the fastest responding drive. It is still possible in theory for a RAID 10 to run with 50% failure of the drives, providing a mirrored pair does not fail, but such action would run a huge risk to the integrity your data. RAID 10 is a common option for high availability servers, such as those running Exchange and SQL databases.

RAID 5 Offers Higher Capacity

RAID 5 stripes the data across the drives, with one drive in each data slice containing the parity information, which can be used to reconstruct the data for a missing drive. This means only the capacity of a single drive is used for redundancy, allowing for much larger data volumes, across the same drives.

A RAID 5 array can run in degraded mode if a single drive fails, but this causes both a performance hit, as well as putting your data at imminent risk. The failure of just one additional drive will cause the RAID to fail. RAID 5 is however still one of the most commonly used RAID array architectures.

Data Recovery Issues

Despite the mirrored drive pairs, RAID 10 arrays are still sometimes seen for data recovery. Providing failures are not ignored, whereby one drive in a mirrored pair could hold out-of-date data, RAID 10 offers a double chance of recovery for each data slice of the RAID, giving extremely high data recovery success rates.

Although RAID 5 arrays have a higher level of risk attached, the data recovery success rate is also very high, as it’s rare for the drive failures to be severe enough to cause the loss of large areas of the data volume.

Any redundancy for your data is certainly a better option than none, so the choice really comes down to budget, and how much risk you’re willing to take with the overall integrity of your data. This needs to be weighed against the possible financial harm your company would face, even for a temporary loss of data access.

Computer Will Not Boot

The reason for a computer not to boot can be due to a large number of different problems. These could be hardware related, or due to corruption of the data used to boot the host operating system. Such problems range from simple issues, right through to complex problems which could risk the integrity of your data.

If data recovery is required, it is important that if problem is the result of a hard disk drive problem, that repeated attempts to boot the system are not made. Some issues such as a clicking drive can cause additional damage on each attempt to boot the machine, making successful hard drive data recovery more problematic.

The Point Of Failure Is Important

It is necessary to determine the point of failure as quickly as possible, to avoid causing further damage, if the problem is caused by a serious hardware fault. The hard drive not recognised by the computer has already been covered.

If the drive is recognised, but does not proceed further, or the message “operating system not found” is displayed, this indicates a hard disk drive issue. If the hard drive makes clicking noises, power the drive down and seek professional data recovery assistance immediately. If this is not the case, it indicates that important data structures at the front of the disk have become corrupt; this also requires data recovery.

Computer Hangs While Booting OS

If the operating system begins to boot, but hangs during the process, this indicates a problem has occurred while the file system is being accessed. This can be due to hardware failure, where the requested sector is unreadable, or logical corruption of the file system.

In either case, repeated attempts to boot the operating system are unlikely to succeed, and in the case of hard drive issues, will potentially make the problem worse. The correct decision at this point is critical, and should be done without panicking, as the future access to your data relies on it.

Repair or Data Recovery?

In almost all situations, hard drive data recovery is the correct course of action. Should you think that it is a computer hardware issue, reading our document about computer repair may help you decide how best to proceed.

If the computer system is relatively old, it is also worth considering whether repairing the hardware makes economic sense, compared to buying a new machine, and having a hard drive data recovery performed to recover your important data files. Also repairing the hardware, does not guarantee that data recovery will not be required anyway.