NAS and SAN Technology

Network Attach Storage (NAS) and Storage Area Network (SAN) units will usually contain multiple hard disks configured as a RAID array. These are attached to the network and present storage space for use by other computers on the network.

Such units were at one time the preserve of the enterprise level market, mostly used by large companies and data centres. With the price of storage dropping over the last 10 years, NAS units have become more common across sectors, with many being used in the home, often as a media server rather than using a computer to act as the server. It is important that these units are configured correctly and their health monitored to avoid problems which can only be resolved through data recovery.

Network Attached Storage

A NAS system once configured is expected to operate with little or no intervention and act as central file storage area, which can be used by any computer attached to the network whatever the operating system, such as Windows, OSX, Linux, BSD etc. These range from simple systems, which allow any user on the network to access the data, through to multiuser systems with storage quotas, to cater for all market levels.

Many of the most recent NAS systems can be configured to automatically backup data to a cloud server. These provide an efficient system for centrally storing data, without the need to share data from an individual computer, which can cause complications, especially when that system needs rebooting. A NAS is intended to act as a continually available file server.

Storage Area Network

A SAN system, usually only seen at enterprise level, is most prevalent in data centres. These are configured to present disk space to a specific machine as though it were a hard disk directly attached to that machine. This is particularly useful when multiple rack mounted servers are being used, where installing additional hard disks would be inefficient and complicate the process of ensuring no data is lost.

These are most likely to be attached to a 10Gbe network in order to provide the kinds of data transfer required. A SAN system will usually contain data from multiple servers, with no knowledge of the underlying file system being used. These are usually meticulously maintained, often with fail over servers in place, making data recovery due to failure very rare.

Correct Configuration and Data Recovery

For a NAS system it is important that when they are configured, that the RAID level used is appropriate for providing redundancy. It is tempting to use a RAID 0 striped configuration as it provides the most efficient use of disk space, but this increases the risk of data loss, as the failure of any disk will cause the NAS to fail. Less efficient configurations are recommended from the most secure RAID 1 mirroring through to RAID 5 which provides a good compromise between data redundancy and disk usage.

At DiskEng we have extensive experience of recovering data from both NAS and SAN systems, with a high level of success. It is usually only multiple catastrophic disk failures or a misguided attempt at recovering the data which can lead to severe or even total data loss.

Why Use RAID 1 Array

RAID 1 often called a mirrored array, utilises a pair of hard disk drives to provide 100 percent data redundancy by ensuring both drives contain the same data, known as mirroring. Despite hard disk drive prices being low, it is rarely seen outside of enterprise solutions, often used for high dependency systems, which are required to run 24/7.

Mirrored arrays are being seen ever more frequently for data recovery, which is because of a couple of factors discussed below. The DiskEng data recovery specialists have extensive experience in recovering data from mirrored RAID 1 systems most usually required following the failure of both disks in the array.

Data Safety Essential

The second disk stores a mirror copy of the data which ensures the highest level of data redundancy possible with a RAID array. Although it halves the potential storage capacity, using a RAID 1 array has little or no drawbacks over using a single disk, despite the requirement to write the data to two drives. Data transfer speeds when reading data may in some cases may see a small increase.

The price per gigabyte of data has dropped rapidly, making the use of RAID 1 architecture more attractive, a significant reason for a corresponding increase in data recovery requirements. Using this type of RAID in high dependency servers may be highly beneficial, but a backup plan should still be implemented in order to guard against any potential failure.

RAID 1 Re-mirror

A RAID array will remain operational following the failure of a single disk, at which point it will run in degraded mode. When a hard disk fails should always be replaced with a new one as soon as practicable, so that the data from the working drive can be re-mirrored.

Data transfer speeds have increased considerably, but at the same time overall capacities of hard disk drives has correspondingly increased. This means that re-mirroring will take a considerable length of time, at which point the data is vulnerable. If you source both hard disks from the same supplier at the same time for use in a RAID 1 array, the possibility of the second drive failing shortly after the first is significantly high. Due to the significantly increased time taken when re-mirroring modern hard disks we are starting to see a rise in the number of RAID 1 arrays which require data recovery.

Data Recovery RAID 1

If your RAID 1 array suffers a failure, which usually occurs during the re-mirroring process, it is important that you do not panic. It is important that both of the original hard disk drives used in the RAID 1 array are sent for professional data recovery. If the failure became apparent during re-mirroring it may be beneficial to supply the new hard disk drive onto which the data was being copied, as important data, vital for achieving a successful data recovery may be contained on the drive.

If the hard disk drive which initially failed is not too far out of date, it can be used by our data recovery specialists to rebuild a fully working array in the event of encountering bad sectors on the other drive. Data loss is only likely to happen in the event of both drives containing the same unreadable bad sector or when the failure of one drive is not acted upon immediately.

RAID “Write Hole” Phenomenon

If a power failure occurs during the write process to a RAID, the “write hole” phenomenon can be the result. This can happen in any RAID array including RAID 1, RAID 5 and RAID 6 whereby it’s impossible to determine which data blocks or parity information was not written to disk.

When this occurs it is undetectable and may go unnoticed resulting in problems at a later time. Although this situation is fairly rare, it can lead to serious problems, especially if a data recovery is required. This highlights why it is important not to become complacent, and think “I have a RAID, so I don’t need a backup” or you could suffer serious data loss.

Data Not Written

As already described, when a power failure occurs it is possible for some data not to be written to all the disks in a RAID array. With modern journaling file systems a power failure is not usually a problem, as any failed writes are still stored in the journal, but a RAID system may be performing many read/write tasks in parallel, which may lead to unusual timing issues.

If the data that was not written is a data block, when the file system is mounted, the journaling may well correct any issue, but any failure to write the parity stripe could cause a serious issue and go undetected until that parity data is required.

Resynchronisation Issues

Take a RAID 1 mirrored pair as an example, whereby data is written to a pair of disks, and a discrepancy is detected between them after a power failure, it is almost impossible to know which disk holds the correct version of that data. In a RAID containing calculated parity information, the same is also true when the parity data does not match the data blocks stored in a stripe.

This means that running a resynchronisation could consolidate the incorrect data as part of the RAID, leading to either corruption of file system data structures or file contents. Scheduled resynchronisation is recommended as part of RAID maintenance, but is not guaranteed to fix this problem. The act of writing data to the RAID will cause the parity in that particular data slice to be resynchronised.

Data Recovery and UPS

Installing an uninterruptible power supply (UPS) for a system running a RAID is the best choice when it comes to avoiding the “write hole” phenomenon. By doing this a controlled shutdown of the server can take place, avoiding the issue of file system corruption.

During data recovery from RAID systems, it is almost impossible to determine which disks hold the correct data if a “write hole” is detected. Through manual intervention it may be possible to resolve some of these issues, but others may be impossible to determine, so it’s important to reduce the risks of suffering “write hole” damage.

RAID 5 vs RAID 10

Redundant Array of Independent Disks (RAID) offers many benefits, from data read/write speed increase through to data redundancy. Each RAID level is a compromise between data security, hardware requirements and read/write speeds.

Your budget will be a big factor in determining which RAID level is most appropriate, but if there is no constraint, data security should be high on the list. No matter which RAID level is selected, it is important not to fall into the trap of thinking, ”I have a RAID, so I don’t need a backup,” otherwise your future will almost certainly include RAID data recovery.

RAID 10 Provides 100% Redundancy

RAID 10 stripes data across a set of mirrored pairs, and therefore requires double the number of drives, for the given capacity required. This provides full redundancy, but as with any RAID system, the failure of one drive could be closely followed another. If a mirrored pair fails at the same time, it will bring the RAID to a halt, so although this gives the best data security, there is still some risk.

RAID 10 can also in many instances provide faster read and write times, as there is no need to calculate parity. RAID 10 hardware is often set up to take the data read from the fastest responding drive. It is still possible in theory for a RAID 10 to run with 50% failure of the drives, providing a mirrored pair does not fail, but such action would run a huge risk to the integrity your data. RAID 10 is a common option for high availability servers, such as those running Exchange and SQL databases.

RAID 5 Offers Higher Capacity

RAID 5 stripes the data across the drives, with one drive in each data slice containing the parity information, which can be used to reconstruct the data for a missing drive. This means only the capacity of a single drive is used for redundancy, allowing for much larger data volumes, across the same drives.

A RAID 5 array can run in degraded mode if a single drive fails, but this causes both a performance hit, as well as putting your data at imminent risk. The failure of just one additional drive will cause the RAID to fail. RAID 5 is however still one of the most commonly used RAID array architectures.

Data Recovery Issues

Despite the mirrored drive pairs, RAID 10 arrays are still sometimes seen for data recovery. Providing failures are not ignored, whereby one drive in a mirrored pair could hold out-of-date data, RAID 10 offers a double chance of recovery for each data slice of the RAID, giving extremely high data recovery success rates.

Although RAID 5 arrays have a higher level of risk attached, the data recovery success rate is also very high, as it’s rare for the drive failures to be severe enough to cause the loss of large areas of the data volume.

Any redundancy for your data is certainly a better option than none, so the choice really comes down to budget, and how much risk you’re willing to take with the overall integrity of your data. This needs to be weighed against the possible financial harm your company would face, even for a temporary loss of data access.

Why Use RAID 5 Array

At one time largely seen as an enterprise only option, RAID 5 has become relatively cheaper, making it an option for small and medium sized companies who require a high capacity file server system.

DiskEng have extensive experience in dealing with data recovery from RAID 5 server systems, from the simplest three disk RAID right through to RAID arrays containing more than a dozen hard disk drives. Due to the complexity of RAID data recovery, an in-depth knowledge of the file system and the underlying RAID architecture are essential.

Compromise of Speed and Safety

RAID 5 stripes the data across the set of drives, which helps to increase the read/write speed. However, this is offset against the need when writing new data, to re-calculate the parity, which is also striped across the drives providing the redundancy.

For many years this was seen as the perfect compromise, and so successful was the hype, that many users failed to realise that a backup plan for their data was still essential.

Built-in Redundancy Allows RAID Array Rebuild

In the event of a single hard drive failure, the RAID 5 array is still able to operate in a condition known as degraded mode. The RAID 5 array must not be allowed to continue operating in degraded mode without further action, as a further failure which could be imminent, would result in a complete failure of the array.

The use of a RAID 5 array allows the failed hard drive to be replaced, and the data and parity information, can then be rebuilt to this new disk. This should be done immediately, as a failure of another drive would make RAID data recovery the only option available for recovering the files.

With disks now storing several terabytes, the time taken to complete a rebuild is considerably longer than with the much lower capacity drives available a decade ago. This increases the risk of a failure occurring during the rebuild, so it is wise to organise a contingency plan while this process is taking place, just in-case a data recovery service is required.

RAID 5 Data Recovery

In the event that more than one disk in a RAID 5 array, or even a failure of the RAID controller, professional help must be sought from data recovery specialists such as DiskEng, who understand both the file system and the underlying RAID architecture.

It is important to make the right decision, as the integrity of your data is paramount. The wrong choice could have serious consequences, for both your data and the future of your company.

Why Use RAID 0 Array

RAID 0 is a misnomer, as the set of two or more disks in the array have no redundancy. The data is striped across the set of disk drives, at a block level, which allows for a volume whose size can be much larger than the capacity of a single hard disk drive. From the viewpoint of RAID data recovery, this can cause issues, so it is important that a backup strategy is in place.

The use of RAID 0 is most useful in an environment where very fast read and write access times are required, particularly for intensive sequential file access. This requirement needs to be weighed against the need for data security, and backup plans put in place should another RAID scheme not provide suitable data transfer rates.

The Need For Speed

Apart from the increased volume capacity, the main selling point for RAID 0 is that, by spreading the data in stripes across an array of disk drives, there will be an inherent increase in the underlying data transfer speed possible.

The seek times for a hard disk are a major factor in determining the speed at which data can be read or written from and to a drive. By increasing the number of disks available, and striping it across the drives, it becomes less of a factor, as the data buffers for each drive will be full for less time.

There Is No In-Built Redundancy

As already mentioned, the big downside of using a RAID 0 architecture, is the lack of any redundancy. The failure of a single drive will result in a failure of the entire RAID array, with data recovery the only solution available, unless that data can be restored from another source.

RAID 0 Data Recovery

When a RAID 0 array fails, it is almost always due to the failure of at least one drive, and depending on the extent of that failure, it can have catastrophic results. Another factor which is of great concern, even if the failed drive is recoverable, is that most RAID 0 arrays are built from disks purchased from a single supplier and the same batch. They operate in the same environment, so once one of the drives fails the likelihood of another failure within 24 hours is high.

It is therefore important, to seek help from a professional data recovery service, to minimise the risk of the failure being compounded through improper procedures. The raw data from all the drives should be secured before any further data recovery procedures are undertaken. Failure to do so, would be negligent, and could result in a situation where the only available option was a data trawl, which would only recover small files, without their original file names.

A data trawl may also be the only option if one drive completely fails and is unrecoverable, so it is important that immediate action is taken after the failure of a RAID 0 data volume.