Data recovery from RAID-0...

When we received two Samsung 160Gb SATA hard drives in a RAID 0 configuration from an SQL server, visual examinations of the drives showed extensive platter damage to drive one in the array. After further examination in the clean room, it was apparent that the head assembly on drive one had crashed and there was extensive scratching to the platters. RAID 0 (striped disks) distributes data across several disks in a way that gives improved speed and no lost capacity and as this array has no actual redundancy, data will be lost if any one disk fails.

A ‘head crash’ had occurred and this 'impacted' the rotating platter surface. The head normally rides on a thin film of moving air entrapped at the surface of the platter. A shock to the working hard disk, or even a tiny particle of dirt or other debris had caused the head to bounce against the disk, destroying the thin magnetic coating on the disk. Since most modern drives spin at rates between 7,200 and 15,000 rpm, the damage caused to the magnetic coating was extensive. The data stored in the media that has been scraped off the platter is of course unrecoverable, and because of the way that data is stored in RAID 0, this data may be whole files or parts of many files.

The second drive was found to be healthy. Drive one was mechanically repaired using donor parts from the second drive. Drive two was healthy and was 'imaged' before being used as a donor. The extensive scratching to the media surface on drive one, only allowed us to gain a maximum 80% image. Once all the drives were imaged, including all the “white” areas (previously deleted or overwritten data), the RAID parameters, such as start sector, drive order, block size and direction of rotation were analyzed to determine the correct values. We then attempted to create a single copy of the reconstructed RAID in a virtual image file (.img).

Although the amount of physical media damage to drive one was extensive, fortunately we were able to recover the majority of data from the RAID. There were many partial files which proved to be too damaged for repair, but there was still enough data to be very useful to the client.