Server Specs & Partition Setup

• Raid 5
• 6- Seagate ST318453LC
• 6 drive elements - Raid 5
• Windows 2003 Server

Crashed Dell Raid 5 Server: Failure Analysis

1. Customer sent all 6 drives unsure of the order of the hard drives
2. Complains that 2 drive elements failed, Raid Server off line
3. We found 1 hard drive had permanent head crash with scratched platters
4. The other failed element had bad sectors and was off line for more than a month
5. The 4 other hard drives were good

Raid Data Recovery: procedures

1. Duplicate as much of each hard drive of the Server immediately
   • We use our own in-house software to duplicate drives with bad sectors
2. Determine the order and stripe size of the Raid Array
   

   You can determine the stripe size by looking at the $MFT record structure to determine the hard drive order (click to enlarge) The File Record Number of the first record is 00 00, followed by 01 00... 02 00...etc. Scroll down the next sectors, you will find the sequence of the Record Number will jump. Keep on following the sequence until the next jump, you should find the Stripe pattern of 128 sectors for each jump. The next 128 sector sequence will be on the second drive of the Stripe Set at the same starting sector. This applies to the standard 64K (128 sector) Stripe of the Dell Server default Raid settings.

   
   

   Once the Drive Order is known, find the 1st drive in the Array. This contains the Partition Table Sector (click to enlarge)

   
   
3. We duplicated as much of the failed hard drive as possible to a spare drive.
4. Then we re-assembled the array and forced the drives back online except for the dead drive..
5. We did not re-initialize the Array, this would have destroyed the Parity Blocks.
6. The Raid was partially corrupted but 95% recovered.