Data Recovery Case File · NAS & Network Storage · Everything Right After Everything Wrong

A New Array Created Over the Old One

This was the most technically accomplished enquiry in the entire archive, and it describes a disaster followed by exemplary handling. A four-disk RAID 5 suffered a dual disk failure; one failed disk later became accessible; and then, "before recovery actions could be completed, a new RAID array was created on the same disks, likely overwriting metadata and some data." Since then: "I have full sector-by-sector images of three of the original disks (the fourth is unrecoverable). All recovery attempts have been performed on images only." The original filesystem was NTFS. That second half is why this case is recoverable at all. He imaged everything and has touched nothing since — which is the single most valuable thing anyone in this position can do.

The decode: what re-creation destroyed, and what it did not

What creating a new array actually writes: less than people fear, and in a very specific place. Array creation writes fresh metadata — the records identifying each disk as a member, its position in the set, the stripe size and the layout — into a small reserved region on each disk. Unless the creation process was allowed to run a full initialisation, the enormous bulk of the disks is not rewritten. So the array's description is destroyed while the striped data underneath it largely survives. That distinction is the whole basis for recovery here.

Why the original geometry now has to be derived rather than read: the description is gone, so the parameters must be established analytically — the order the disks were in, the stripe size, which direction parity rotated in, and the offset at which data began. Each of those is discoverable from the data itself: filesystem structures appear at predictable places, stripe boundaries reveal themselves where file content is interrupted, and parity relationships can be tested across candidate layouts until they hold consistently. It is careful work rather than guesswork, and it is exactly the work that a re-created array makes necessary.

Why three of four disks is enough: the encouraging arithmetic. RAID 5 stores parity distributed across the set specifically so that any one member can be lost and reconstructed from the others. With three original members imaged, the fourth can be computed rather than read — provided the geometry is correct. So the unrecoverable fourth disk is not fatal; it is precisely the situation the array design anticipated.

Why his discipline is the reason this is possible: the point worth stating loudly. He took full images before working, and every attempt since has been against copies. That means every wrong hypothesis about geometry costs nothing and can be retried; the originals cannot be degraded by experimentation; and if a promising approach turns out to be mistaken, the position is exactly where it started. Most cases of this kind arrive after somebody tested theories on the disks themselves, at which point each failed attempt has made the next one harder. He converted an unrecoverable situation into an analytical one.

The honest position: where the new array's metadata regions overlapped genuine data, those areas are lost — and with a fourth member unavailable, any region where a second member also fails to read cannot be reconstructed. So this is a strong candidate for substantial recovery with named losses rather than a guaranteed complete one.

On the bench

All work was conducted exclusively on the supplied images, as he had established, so that every hypothesis could be tested and discarded without cost. The original geometry was derived analytically rather than read — member order, stripe size, parity rotation and start offset established by testing candidate layouts against surviving NTFS structures and against parity consistency across the three imaged members. The missing fourth member was computed from parity rather than substituted. The NTFS volume was then located beneath the new array's metadata, reassembled offline, and every unreadable region resolved to the individual files it affected.

The outcome

The original geometry derived analytically, the missing member computed from parity and the volume reassembled offline with losses mapped per file. Free assessment, one fixed written figure including VAT; where a drive has to be opened, 50% of parts and labour is payable upfront with the balance only on success — otherwise no recovery, no fee. The decode, for anyone who has re-created an array by mistake: creating a new array writes fresh metadata into a small reserved region rather than rewriting the disks, so the array's description is destroyed while the data underneath largely survives; the original geometry must then be derived analytically from filesystem structures and parity consistency; RAID 5 permits one member to be computed rather than read, so a lost disk is survivable; and imaging every member first, then working only on copies, is what makes any of it possible.

Our case files are drawn from genuine enquiries received by our laboratory over the past ten years, anonymised to protect client confidentiality. Each one describes the diagnostic and recovery procedure our engineers apply to that fault, using the equipment listed.