Key Phases

  1. The client reached out to Stellar Data Recovery Service
  2. We helped the client deliver the relevant equipment
  3. Our project team diagnosed the root cause and recovered the lost data
    1. Examined the crashed storage system for physical and logical errors.
    2. Transplanted the read/write head in the damaged hard drive
    3. Cloning of remaining HDDs and construction of virtual RAID
    4. Logical scanning to retrieve required data, followed by manual fixes
  4. The client verified that the recovered data was complete and correct
  5. The client resumed their business processes

Summary

The client was using Synology DiskStation DS412+ 4-Bay NAS Enclosure with 4 x 4TB HDDs.

One of the drives was physically damaged. On replacement with a new HDD, a new volume was created, which made a lot of data inaccessible.

RAID data recovery experts from Stellar diagnosed the root cause, transplanted the damaged read/write head, cloned the HDDs, and constructed a virtual RAID to recover all lost data.

Background

  1. The client’s office premises are monitored via multiple IP cameras. The video footage is centrally stored in a NAS.
  2. The NAS is a Synology DiskStation DS412+ 4-Bay NAS Enclosure with 4 x 4TB HDDs.
  3. The NAS storage system crashed. The client observed the error message ‘one HDD failed’ on the NAS display.
  4. The in-house engineer at the client’s location intended to rebuild the RAID. He replaced the faulty hard drive with an equivalent new hard drive.
  5. This created a new volume.  As a result, the client lost access to all the stored data.

Hardware Setup

  1. Synology® DiskStation DS412+ 4-Bay NAS Enclosure
  2. 4 SATA HDDs-with each 4 TB capacity. 
  3. Q24M Secure Cameras NVR

Error Message

Hard Drive Failed.

Business Impact

How did the crash affect the client?

  1. The client lost access to crucial video footage.
  2. They were exposed to the risks of non-compliance with data security and stewardship regulations.
  3. They were unaware of the root cause of the problem, and hence unprepared for similar future events.

Data Recovery Challenges

The engineering team was tasked with the following challenges.

  1. Identify the cause for the loss of access to data.
  2. Diagnose the nature and extent of damage to the faulty hard drive.
  3. Find a way to clone all the hard drives in the surveillance station and recover the data.
  4. Manually extract MPEG files of specified date using disk-editor software
  5. Reconstruct the data and make it available in a suitable file format.

Key Phases

1. The client reached out to Stellar Data Recovery Service

The client reported the incident to a Stellar Data Recovery expert on the phone. Our data recovery consultant asked all necessary questions to estimate the nature and extent of the damage. We advised the client to not experiment with the NAS storage, as that would have made the recovery process more difficult.

2. We helped the client deliver the relevant equipment

We understood all about the equipment attached to the NAS system and instructed the client to carefully disconnect it from their electrical supply system. Then, we instructed them to pack the equipment so that it could be delivered safely to our data recovery lab, without any risk of physical damage.

3. Our project team diagnosed the root cause and recovered the lost data

Given that this was a case of physical and logical damage, we organized a project team with the required experience and skill set. We set up a 4 member engineering team which included:

  1. Engineer from our state-of-the-art Class 100 Clean Room lab
  2. Engineer from the R&D department
  3. Engineers from the RAID recovery team

Step 1: Examination of the crashed storage system for physical and logical errors.

Observations

  • In one of the HDDs, the read/write head was broken
  • Remaining three HDDs were working fine
  • File system information was missing on regular intervals in the RAID5 configured HDDs

Step 2: Transplantation of the read/write head in the damaged hard drive

  • Sought permission from the client to transplant the broken read/write head
  • Carried out successful transplant in our state of the art Class 100 Clean Room
  • Cloned the hard drive successfully to a new hard drive
  • Compared the information in the cloned hard drives on a sector-by-sector basis with the information stored on the original hard drive
  • Found no discrepancy on cloned HDD

Step 3: Cloning of remaining HDDs and construction of virtual RAID

  • Cloned the remaining 3 hard drives
  • The RAID team then connected all the 4 cloned Hard Disk Drives on a special server
  • Scanned the drives with a specialized RAID recovery proprietary tool for finding
  • The RAID array logical parameters such as stripe size, data flow pattern, and parity flow information
  • Byte-to-byte scanning for data and parity flow revealed that storage had a Linux file system structure with RAID5 configuration
  • Reconstructed the single RAID (final) image. Its volume had an Ext4 file system in which the required data was entirely inaccessible
  • Because the client had made a new volume that resulted in overwriting some of the critical information, some files’ inode were missing and corrupted

Step 4: Logical scanning to retrieve required data, followed by manual fixes

Logical scanning didn’t yield the desired results.

So, our RAID data recovery experts:

  • used proprietary advanced RAID data recovery software with file-signature-based deep scanning function on the single RAID reconstructed cloned Hard drive.
  • found traces of the expected data in the volume
  • used proprietary utilities to manually extract MPEG files of required date using disk editor software
  • reconstructed the data into required files format (Camera footage video).
  • successfully exported the recovered data to a secure storage server.

4. The client verified that the recovered data was complete and correct

Our recovery experts then worked with the client to verify that all the recovered data was valid.

5. The client resumed their business processes

The client then collected their storage equipment from our premises, re-connected, and found their storage process was successfully restored and working as usual.

Success Factors

The following actions helped us ensure quick and complete data recovery

  • Putting together the right core engineering team
  • Relying on our standard diagnostics and recovery processes in compliance with ISO 9001-27001 guidelines
  • State-of-the-art Class 100 Clean Room where the critical transplantation of the read/write head was carried out safely
Client Statement

Statement from the customer:

"Stellar’s skilled team and ISO 9001-27001 compliant recovery processes gave us confidence throughout. Their Class 100 Clean Room ensured our read/write head transplant was performed with precision and care, making our data recovery journey seamless."

Individual User

Read More Case Studies

Stellar Client

Corporate User

Successful Recovery From RAID 5 Server Hit by LockBit 3.2 Ransomware

Read Case Study

Stellar Client

Automobile Manufacturing Company

Data Recovery From Ransomware-Affected Virtualization System

Read Case Study

Stellar Client

Corporate User

Recovered 512GB from a Physically Damaged MacBook® Pro with APFS Encryption

Read Case Study

Stellar Client

Individual User

Data Recovery from a TRIM-Enabled LITE-ON 120GB SSD

Read Case Study