Altirium logo

Is a NAS RAID reconfiguration the end of your data?

The popularity of Network Attached Storage (NAS) RAID units has never been higher. For a small outlay a low powered, easy maintenance, storage device of 1TB or higher can be plugged in and used where once an expensive server with disk storage would have been the only option. Whilst RAID5 gives a high degree of reliance against the failure of any one disk in the NAS unit, other problems can result in an apparent total loss of data and a requirement for a NAS Data Recovery.

A NAS storage deviceĀ  in need of recovery was delivered to us last week. The customer had been using the device and on Friday evening all data was present and correct, but when the customer went to access the device on the Monday morning it was operational but there was no data present. So where had it gone and could a data recovery be achieved?

Once the data from the disks had been secured by imaging the disks and backing up the data our diagnosis began. The RAID unit was basically a Linux system in a box with four hard drives, and used the XFS file system to store data. Using the file system structures from within the XFS file system we were able to identify that the RAID used a stripe size of 64KB and with a standard data order, so far so good. The problem was that when we then examined that data from the disks using this RAID configuration, and attempted to follow the XFS INODE information to access the files something did not seem quite right. We dropped the data from the RAID onto a single disk and connected it to a Linux system, and were able to mount it without any errors, but only three directories were visible so it appeared that there had been either file deletion of a file system re-creation, but our utilities did not indicate a problem, so what was wrong?

On closer examination of the hard drive images, we were able to find the answer and it makes for quite scary reading. Yes, there had been a file system re-creation, but before this the RAID had been re-configured. A previous RAID configuration on the device had used a stripe length of 16KB and whatever had happened over the weekend had resulted in the RAID being reconfigured, rebuilt and a new file system written to it. Armed with this information the new RAID configuration setting were used with our data recovery software. When we examined the resultant data produced with these new settings, we were surprised to find that the previously existing filesystem was almost entirely intact and approximately 99% of the customers data could be recovered.

How was this possible? First, the reconfiguration of the RAID did not cause the parity blocks to be recalculated for the entire RAID volume, parity was only written in the stripes where new data was written. Second, the change in the RAID stripe size caused the allocation group size of the XFS filesystem to change, shifting the location of internal filesystem data and therefore preserving many of the previous XFS structures that we were then able to use to reconstruct the previous filesystem.

The moral of this story? We see many instances of NAS RAID systems that have apparent failures or where some level of rebuilding has taken place. This is not an attempt to disparage what is a highly important type of storage in terms of ease of use and cost, but it does demonstrate a failure to comprehend the risk of reliance upon a single storage device for critical data almost as if the fact that a RAID is in use gives complete protection against failure. For the cost of a NAS data recovery a tape device, or additional NAS units to backup up to, could have been put in place resulting in no need for data recovery work and no interruption to business and to sleep patterns.

VN:F [1.9.22_1171]
Rating: 10.0/10 (1 vote cast)
Is a NAS RAID reconfiguration the end of your data?, 10.0 out of 10 based on 1 rating

One Response to “Is a NAS RAID reconfiguration the end of your data?”

  • The article was very helpful when I discovered it with live search on Saturday by my search for ipad. I have your blog now in my book marks and I will check out your blog again, in the near future. Take care.

    VA:F [1.9.22_1171]
    Rating: 0.0/5 (0 votes cast)

Leave a Reply