Data Recovery from RAID 5
RAID 5 has at least three drives. Data is stored in stripes of a specified block size. There are many similarities to this technique as in RAID 0 however Unlike RAID 0 there is redundancy built in to RAID 5. Redundancy means that if a single drive fails, then the data can be rebuilt from the working hard disks in the array. The redundancy is in the form of a parity block, using a three drive array as an example, redundancy for the first stripe would be calculated by taking each byte from each block from the first two drives, then XORing these values to give. It is this value that is stored in the parity block for the current stripe. So, when a hard disk in the array fails, the missing value can be regenerated or rebuilt by XOR-ing the remaining two values. This does increase write times slightly as the parity needs to be calculated.

Rebuilding a RAID 5 Array After Failure
The issue for data recovery engineer is calculating the original order the drives were in, block size and parity rotation methodology.

There are many permutations and these are compounded by the number of drives in the array. For example if you have a RAID array with 5 drives there are 120 permutations of drive order alone. Then there is the block size to take into account. These are not as complex to calculate, but can be any size from 2048 bytes upwards. However, the most common sizes are 32kb 64kb, 128kb and 256kb.

Once drive order is determined we now needto calculate the parity rotation. Because the parity stripe is ‘rotated’ this means that for each complete stripe, the parity block moves to the next drive in the sequence. As an Example, if you take 3 drives and number them 0,1 and 2 below is a diagram showing where the data blocks are (shown as numerics) and the Parity block (P).

Drive 0: 1 3 P 7
Drive 1: 2 P 5 8
Drive 2: P 4 6 P

You can see that the first parity block is on drive 2. The next parity block is on drive 1 and last one is on drive 0. Then the sequence repeats itself until the end of the array.

Initially this looks fairly straightforward, and in fact the above is the simplest RAID 5 there is.

here is another type of parity (Backward with continuous data)

Drive 0: 1 4 P 7 10
Drive 1: 2 P 5 8 P
Drive 2: P 3 6 P 9

There is a subtle difference where blocks 3 and 4 (and 9 and 10)are flipped. This is because once the first stripe is complete. The first data block of each stripe must go directly after the parity block so the drive reads the data as 0,1,2,0,1,2… So in this case block 3 is placed after the parity block on the second stripe. This improves read and write speeds so that the same hard disk is not read twice in succession. A mistake in calculating the block[spin/] rotation selecting a company to recover your data, make sure they fully understand the technologies employed in RAID of any level. Full understanding of how data is stored on disk is critical if the data is to be recovered correctly. MjM Data Recovery Ltd have developed their own software that they use for RAID data recovery and have engineers that are able to recover from the most difficult of jobs. If another data recovery company has told you that the data is unrecoverable, it is always worth sending it to another company for a second opinion. Most will not charge for a diagnosis or it will be a relatively small charge if the value of the data warrants the cost.