Case Study
Stellar® Recovers Data from 25 Virtual Machines on Failed HPE StoreEasy® NAS Configured with RAID 5
Business-critical data of the organization was at risk.
Overview
The client is a leading independent software testing and test automation services company. It provides testing and test automation solutions to its global customers, including Fortune 500 companies.
The organization used an HPE StoreEasy® 1460 Network-Attached Storage (NAS) server comprising a 24 TB volume stacked with four Serial Advanced Technology Attachment (SATA) Hard Disk Drives (HDDs), each having 8 TB capacity. The volume was configured to RAID 5 functioning on the NTFS file system.
The NAS server was used as the centralized space for storing and retrieving documents, reports, data files, images, videos, and other business-critical information.
Microsoft Hyper-V was used to manage several virtual machines (VMs) hosted on the physical server. These virtual machines were routinely accessed by the company’s users working on different operating systems.
In one such usage instance, when the organization tried to access the virtual machines on RAID 5 volume, they received an HDD failure error.
The RAID had failed due to which the users lost access to the virtual machines having business-critical data.
Business Impact
RAID server failure and inaccessibility of virtual machines resulted in a large-scale outage due to which the organization lost access to its business-critical data. This situation hampered its business continuity and productivity while posing a risk of data loss. The organization needed to recover data from the virtual machines installed on RAID. So, it reached out to Stellar® for RAID 5 virtual machines data recovery.
Problem Statement
Recover Virtual Machine data from failed NAS storage server configured with RAID 5 volume.
Data Recovery Challenges
Following were the technical challenges for this RAID 5 virtual machines data recovery case:
- Recover data from physically damaged HDDs configured as RAID 5
- Extract virtual machines from the physical host
- Repair corrupted virtual machine files to extract the data
Data Recovery Approach
Stellar® data recovery experts along with the in-house R&D team performed an in-depth diagnosis of the failed storage. They followed the below steps for RAID 5 virtual machines data recovery:
Step 1: Lab Examination of Hard Disks
Stellar ® data recovery team examined the four hard disk drives used in the RAID and found two of these hard drives were not functioning with signs of physical damage (
clicking noise).
This finding indicated that the two drives were physically crashed, leading to RAID failure.
Step 2: Hard Drive Head Assembly Replacement
The team sought tampering permission* from the client organization to open and perform root-cause analysis on the affected hard disk drives.
Subsequent analysis of the hard disk drives in Class 100 Clean Room lab revealed broken head assemblies and visible scratches on the platters.
The team transplanted new head assemblies on these hard drives to restore their functioning to allow the feasibility checks for data recovery.
However, the hard drives remained inaccessible even after head assembly replacement. The read/write heads were touching the platter, which could further scratch the platter and lead to permanent data loss.
Considering these were high-speed HDDs, it was challenging to read the storage sectors without risks of scratching the platter. The team came up with a proprietary mechanism to control the hard drives’ spindle speed and bring them back to a functional state to perform the next steps.
Step 3: Hard Disk Cloning
Stellar ® team cloned** the four HDDs by using a proprietary disk cloning software.
Next, the team verified the RAID array configuration to determine the data recovery approach.
They connected the cloned hard drives to a specialized RAID system and used a hex editor to find:
- RAID configuration
- Hard disk sequence
- Stripe size (storage capacity of each HDD)
- Flow of data
- Parity distribution
A byte-wise analysis revealed that the HDDs were configured to RAID 5 with the NTFS file system in Windows.
The NAS volume had Hyper-V installed to run multiple operating systems as virtual machines.
These findings were vital for proceeding to the next Raid 5 recovery steps.
Step 4: RAID Re-Construction
The next step was to create a single drive out of the four drives configured as RAID 5 in NAS storage. The team used a proprietary tool to construct a single image of the four RAID 5 configured
hard disk drives for Raid 5 Recovery .
Step 5: Deep Scan of the NAS Drive Image
The data care experts used Stellar® Data Recovery Technician software to deep scan the NAS drive image. The software retrieved 25 virtual machine files in VHDX file format
***.
The next step was to extract data from 25 virtual machines. However, the recovered virtual machines were found corrupt and inaccessible.
Step 6: Repairing the Corrupt VM Files and Data Recovery
On deeper probing, it was found that the header information in the virtual machine files was missing.
Stellar® R&D team studied the file structure using an indigenous tool and manually created the missing file header.
After repairing the highly compressed virtual machine files, the team extracted 11 TB data in a readable format. The data was recovered with original format as validated by the client.
Result
Stellar® recovered 100% data from 25 virtual machines installed on the RAID 5 volume in HPE StoreEasy 1460 NAS server.
The team successfully completed the RAID 5 virtual machines data recovery project within the specified time.
Stellar® maintained a strict adherence to the ISO 27001 standards for ensuring the confidentiality, security, and privacy of the client’s data.
*Stellar® follows a strict policy of seeking explicit permission from the clients before opening up any storage media for physical diagnosis.
**Stellar® performs data recovery operations only the virtual image of the storage media. It does not operate on the restored physical media.
***VHDX or Hyper-V virtual hard disk is a Windows virtual hard drive file that can store up to 64 TB data.
Statement from the customer:
"Stellar successfully recovered 100% of our data from 25 VMs on a RAID 5 volume deployed on the HPE StoreEasy 1460 server. Their expertise brought back our critical virtualized environment seamlessly."
Test Automation Services Company
Read More Case Studies
Corporate User
Recovered 512GB from a Physically Damaged MacBook Pro with APFS Encryption
Individual User
Data Recovery from a TRIM-Enabled LITE-ON 120GB SSD
Leading Mining & Natural Resource Company
RAID 5 Recovery - 25 TB Data Recovered for a Prominent Mining & Natural Resource Company
Leading Matrimonial Services
