Data Recovery Case File · NAS & Network Storage · Nothing Is Broken

The Disks Are Fine and the Arrangement Is Gone

This enquiry contains no fault at all. Three array drives "from a disassembled workstation. The drives themselves are intact and there was no prior issue." The machine was taken apart and the disks came out. Everything anybody would call broken is working perfectly — what was lost is the arrangement that made three disks into one volume, and that lived in the machine rather than on them.

The decode: what an array is, and where it was kept

What three disks in an array actually are: three ordinary drives, each holding fragments of a volume that only exists when something knows how to combine them. The knowledge is the array — which disk comes first, how large each piece is, whether parity is present and where it sits. Individually, each drive holds recognisable data in an unrecognisable order.

Where that knowledge lived: partly in the machine's controller — its make, model and configuration — and partly written onto the disks themselves as metadata. The first left with the workstation. The second is still there, which is what makes this recoverable.

Why dismantling is a genuine cause of data loss even with everything intact: nobody thinks of a working machine as containing information that is not on its disks. The physical order of the drives, the controller they were attached to, the ports they occupied — all of that is configuration, and all of it is discarded the moment the case comes apart, usually by somebody who did not know they were discarding anything.

What survives anyway, and it is usually enough: most array implementations write a metadata block to each member recording the arrangement — the member's position, the total count, the stripe size, and an identifier tying the set together. That is read off the disks and reconstructs what the controller knew, which is why this case is workable rather than hopeless.

Why it is confirmed rather than trusted: metadata can be incomplete, and different implementations record different things. So the arrangement is verified by content analysis — assembling the volume and checking that filesystem structures land where they should, that files reconstruct coherently, and that the result reads as a volume rather than as noise. A wrong stripe size or a wrong member order produces something that mounts and contains rubbish, which is the failure to guard against.

Why the disks are imaged before anything is assembled: assembly is trial and error against the metadata, and every attempt should happen against copies. Working on the originals risks a controller or utility deciding to initialise a set it does not recognise, which writes over exactly the metadata being read.

The practical lesson, and it takes thirty seconds: photograph the inside of any machine before dismantling it. Ports, cables, drive positions, model numbers. The picture costs nothing and it is the configuration.

On the bench

Each drive was imaged individually write-blocked before any assembly attempt, assembly being iterative and every attempt properly performed against copies rather than originals. Array configuration was determined from on-disk metadata rather than recollection — most implementations writing a block to each member recording position, member count, stripe size and a set identifier, which reconstructs what the departed controller knew. Member order and stripe parameters were confirmed by content analysis, a wrong parameter producing a volume that mounts and contains noise.

The outcome

Every member imaged before any assembly, the configuration read from on-disk metadata and confirmed against content, and the volume assembled offline. Free assessment, one fixed written figure including VAT; where a drive has to be opened, 50% of parts and labour is payable upfront with the balance only on success — otherwise no recovery, no fee. The decode: nothing is broken. Three array disks are three ordinary drives holding fragments of a volume that only exists when something knows how to combine them — and that knowledge lived partly in the machine you dismantled. Most of it is also written on the disks.

Our case files are drawn from genuine enquiries received by our laboratory over the past ten years, anonymised to protect client confidentiality. Each one describes the diagnostic and recovery procedure our engineers apply to that fault, using the equipment listed.