We help IT Professionals succeed at work.

how do they recover data

al4629740
al4629740 used Ask the Experts™
on
We had to spend over a thousand bucks to recover data off some RAID Mirrored drives that could not be recognized.  I always wondered, what are they exactly doing to get the data?
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
Commented:
it depends about the issue that you were facing in each drive sometimes when you are facing physical errors like damaged controller, you will try to get another controller of exact same time... so that you can make the disk run...  Sometimes the errors are just logical errors... in resume it depends on the case that you have in hands...
since the raid is mirrored raid shouldn't be a problem but a solution....
It depends on what procedure they need to perform. If your drives are no longer recognized because of a failed controller, they either need to find an identical controller, or discover identical RAID configuration parameters using a different controller, or software that can reconstruct the RAID virtually.

If the controllers on the drives fail (which can also be common, due to drives usually being identical, and from a similar batch or production run), then the controllers may need to be replaced (which is the silicon-based board you see on the bottom of the drive. The problem is that controllers go out of style quite quickly, with the same model drive getting revised controllers throughout the span of it's production lifetime. Hunting down identical controllers is where the fun begins.

There may be other issues, such as identical drives suffering internal problems, such as head damage, bad sectors, seized motors, or attempting to operate outside normal operating parameters. Some of these issues can be fixed by opening the drive(s) in a clean-room and replacing components as necessary.

There are other methods that can be performed, it just depends on your circumstance. If you want to know more about your particular instance, you could reply with the scenario under which you had to send your drives in for recovery?

Cheers - Mark
DavidPresident
Top Expert 2010
Commented:
Basically, you first assess the HW, and get out the bunny suits if necessary to get you a range of known good & bad blocks on the HDDs.
Then you run pattern recognition software (the good stuff is written in-house) to figure out the RAID topology, block size, and partitioning & file system info.   Goal is to get a logical device that your  O/S uses.   Then file system recovery work.

Lots and lots of corner cases, like if a rebuild was partially completed;  bad stripes; incorrect block XOR values.  

Sometimes you have to write code on the fly  as well. Type of RAID controllers and metadata (data about the data), is also a factor.  
1,000 sounds cheap.  I've paid anywhere between $800-2,500 for single hard drives.  Workers in bunny suits disassemble the hard drive in a clean room.  They remove the platters and reassemble them into a new drive assembly.  Then they stream the data off bit by bit.  They archive the data stream, copy it, then start analyzing the copy.

After that, they replace the platters in the original drive, screw everything back together, reassemble case (if any) and put a seal on the drive with the name/logo of the recovery company.  Hard drive manufacturers will honor the warranty if the drive is re-sealed by a known data recovery company.

For RAID recovery that cheap, you may have had physically intact drives.  I'm not familiar with the ways of a RAID "recovery".  I've seen them happen in minutes with getting the drives in the proper order and taking settings to a new compatible RAID card.  I've also seen software that streams data off each disk then tries to verify the parity bit and write everything out to a single volume.
SteveArchitect/Designer
Commented:
in basic terms, recovering data from drives depends on how bad the issue was.
basic steps are as below:

Get hardware into a state where it can be accessed, if it isnt already.
>this may mean physically repairing or rebuilding the disks.

Assess the data on the disks.
>software looks at the contents of the disks and checks how badly damaged the data is.

Read the data.
>in bad cases the data is read in a raw format (1s & 0s) and then clever software tries to work out how to turn it back into files.
>in better cases, some fairly simple software can work out which 1s & 0s form part of which files and just go from there.

In RAID situations, they have to work out the RAID layout in addition to the data, as the data may be spread across multiple drives.
For RAID mirrors, they often read the data from both drives independantly and compare the two to see where errors may exist.