Stellar^® Recovers Data from Physically Failed Netgear^® ReadyNAS Configured to RAID 5

Problem Statement

Recover data from failed NAS configured to RAID 5 volume comprising physically crashed and formatted HDDs.

Data Recovery Challenges

• Manual recovery of snapshots from damaged and formatted HDDs.
• Cloning of HDD with scratches on the platter.
• Decompression of snapshots to extract data.

Data Recovery Approach

Stellar^® data recovery experts and the R&D team performed an in-depth diagnosis of the failed NAS. They employed the following steps to recover data from the failed RAID 5 volume:

Step 1: Lab Examination of Hard Disks
The RAID data recovery team examined the five HDDs and found that one of the hard drives was not functioning.

The drive was making a clicking noise, indicating a physical failure.

Step 2: Hard Drive Head Assembly Replacement
After receiving hard drive tampering permission^*, the team opened the physically failed HDD in Class 100 Clean room Lab.

The hard drive head was found broken, and there were many visible scratches on the platter.

The data recovery experts transplanted new head assembly on the failed HDD to restore it to a functional state and make it ready for disk cloning.

Step 3: Hard Disk Cloning
The team cloned^** all the hard disk drives by using a proprietary disk cloning software.

It was challenging to clone the hard drive whose head was transplanted due to deep scratches on the platter coating. The team devised a mechanism to control the hard drive spindle speed and read data bypassing the deep scratches on hard disk platter.

Step 4: Virtual RAID Construction
The next step for Netgear^® storage box recovery was to construct the virtual RAID.

First, the team verified the RAID array logical parameters viz. RAID configuration, strip size, flow of data, and parity distribution. This was necessary to determine the crashed Netgear^® ReadyNAS recovery approach.

A byte-wise analysis for data and parity flow revealed that the Netgear^® storage had Linux volume with BTRFS file system and RAID 5 configuration.

Next, the team used a proprietary tool to create the virtual RAID of the cloned hard disk drives.

Step 5: Deep Scan of NAS Drive Image
After virtual RAID construction, the team performed a deep scan on the storage drives image. However, the scan results showed the drives as empty.

On enquiring, the client informed about formatting the HDDs during the RAID rebuilding process but not adding any data after formatting, due to which the RAID volume information was deleted.

Step 6: Data Recovery via NAS Snapshots
Stellar ^® data recovery experts decided to recover the data from Netgear^® ReadyNAS via the snapshots.

Snapshots are a kind of data archives automatically created at regular intervals in NAS servers. They are highly compressed files saved on the same volume as the users’ data. In this case, the client’s ReadyNAS created snapshots every 24 hours.

The team manually extracted eight snapshots from the formatted disks by using hex editor tool. Further, they used indigenous software to decompress the snapshot files.

The recovered data comprised of Office documents, Excel files, PDFs, and e-mails. All the files were accessible and in a readable format as validated by the client organization.

Stellar^® team was able to recover approximately 4.5 TB data from Linux-based RAID 5 volume.

Result