Kroll-Ontrack Rescues Data From RAID 5 Disks After Server Failure

by Wayne Rash

Kroll-Ontrack senior clean room engineer Peter Brown takes a first look at Drive 1 of the RAID 5 array from my failed Buffalo LinkStation Quad NAS server. Brown does an initial physical inspection of the drives before digging deeper.

Brown removes each drive from the dead server and places it carefully into a plastic tray, keeping the disks from the array together and in order. Once the drives are removed from the server, Brown takes them to a workstation to log them into Kroll-Ontrack’s recovery system.

Brown records the details of each disk drive into Kroll-Ontrack’s recovery system. He has a bar code scanner to record the serial numbers. Each drive is individually tagged on each side to uniquely identify the drive and its position in the RAID 5 array.

With their details recorded and logged into the Kroll-Ontrack data recovery system, the drives are ready for the next step—pulling the data off the drives in the clean room. The drives are accompanied by their paperwork at each stage of the process to avoid any possibility of loss or confusion.

Each drive is attached to a custom-built computer and the data copied to the servers at Kroll-Ontrack. Because this is a RAID 5 system, data is stored separately for each drive. Once the data is copied into the servers, the four disk images are combined into a virtual array, and then virtually reassembled. Once this is done and the data is reassembled, then it’s copied to another disk drive large enough to hold everything. Had my drives been physically damaged, the clean room would also be the place where the data would be recovered from the non-functioning drive. Fortunately, that wasn’t necessary for my recovery operation.

Engineers such as Peter Brown can recover data from a failed drive by opening up the drive and either repairing the failed components or removing the drive platters so they can be read using another hard-drive enclosure. Engineers use the tweezers to work on the small components inside the drive enclosure.

This drive was under 200 feet of seawater on the bottom of the ocean after a shipwreck. As you can see, the drive’s seals can’t hold water out forever, so eventually water, accompanied by lots of crud, accumulates. Kroll said 99 percent of the data on this drive was successfully recovered.

This hard disk was installed in the Space Shuttle Columbia when it made the flaming re-entry that destroyed the spacecraft on Feb. 1, 2003. The shuttle’s pieces were spread across a swath that reached from Texas to Louisiana. This drive lay in a dry lake bed for six months. When it was found, the staff at Kroll-Ontrack said that it looked like nothing more than a lump of burned metal. Note that the heat was so extreme during the disastrous breakup of the shuttle that the solder holding the components melted, allowing them to come free, as was the case with the chip shown here. Despite the extreme heat, the impact and being exposed to the environment for six months, 99 percent of the priceless scientific data contained on this drive was recovered.

This is the clean room at the headquarters of Kroll-Ontrack in Minneapolis, where the toughest recovery jobs happen. The engineers seem to be able to recover data from nearly anything.