RAID 1 Data Recovery.
Over the last couple of years we have noticed an increase in number of RAID 1 disk sets being brought in for data recovery, and fewer RAID 5. This is to be expected given the capacity of HDDs has grown significantly during this period so having 3 or more drives is just not needed to give a decent sized file server or shared storage space. Unfortunately some people do think that having a RAID (in particular a RAID 1) is as good as having a well managed backup. It is not.
As I type data is currently extracting to our server for an ‘Emergency’ service level job (24 to 48 hours) from a pair of RAID 1 arrays. In this case one of the HDDs had an intermittent failure (WD5000AAKS Tornado PCB fault for those who are interested). The result of this was that the bad HDD dropped out then in and then out of the RAID array on a reboot of the server. Unfortunately the RAID controller got a bit confused and started integrating old data into the most up to date disk. Oh dear. Those familiar with rebuilding RAID arrays know that the number one reason for a non-recovery is a bad rebuild. Once new data has been written on top of the target data there are not many options available other than looking for previous file fragments, shadow copies or the relevant backup files.
In this case the rebuild wasn’t too bad, and we have been able to fully recover data from both of the failed disks from the RAID 1 and now are piecing together the most coherent data set. Yes it is an exciting weekend activity, but knowing that this database is critical to the running of a large firm of solicitors and on Monday they’ll be twiddling their briefs without it, the fastest service level was requested, which does mean a couple of late nights and early mornings for those trying to recover the data here.
Generally RAID 1 does provide more reliability than a single HDD. However, in this case if there had only been a single disk with the data on it’s very likely that we would have dealt with the firmware/ROM issue the HDD was suffering from and made a full recovery of the data. In the present state it is likely there will be some data corruption (albeit a small amount hopefully). Of course is there had been a single HDD and there had been a head crash then it would not have been possible to recover any data.
What of their server backup you ask? Well there’s a combination of corrupt BackupExec files, and a password and encryption key that the system administrators aren’t sure of (there was a recent change in IT support for the solicitors’ firm.) So the rule is, check on your backup, check that it is ready for that moment of disaster. Whether it be tape, external HDD or cloud based storage, the backup might not be working quite as you expect at your moment of need.