Data Recovery Case File · Software RAID · Storage Spaces

The pool that crashed its own manager: Storage Spaces, ReFS, and a recovery done where nothing could freeze

This customer ran storage most home users never touch: a Windows Storage Spaces pool of four members — two 2TB hard drives and two 60GB SSDs — carrying two mirrored virtual drives on the ReFS filesystem. It had worked until two changes landed together: a Windows 10 version upgrade, and the pool's migration to a different PC. Afterwards, connecting three or four of the members didn't just fail to mount his data — it crashed the Storage Spaces window and froze Windows solid, forcing hard power-offs. Official support's escalation path ended, remarkably, at "reinstall Windows." He declined, and asked better questions instead.

What Storage Spaces really is — and why the crash was a warning, not a nuisance

Strip the friendly name and Storage Spaces is software RAID: every member drive carries pool configuration metadata describing how the virtual disks are diced into slabs and scattered across the physical members, and Windows reassembles the illusion live, on connection, every time. Which reframes his crashes ominously: each attachment attempt was the operating system actively parsing damaged pool metadata — and choking on it — with the drives online and writable underneath, and each forced power-off was another unclean interruption landing on the very structures already hurt. Live troubleshooting of a wounded pool is troubleshooting inside the patient. And "reinstall Windows" deserves its grade in print: F — a fresh OS meeting the same damaged metadata either fails identically or, worse, offers to helpfully reinitialise what it can't parse. The correct venue for a broken pool is the same as for any broken array in this archive: offline, on images, where nothing can crash, freeze, or write.

The reconstruction

All four members were imaged write-blocked on the TaskForce 2 — the step that retired every risk in the case — and the pool was then rebuilt where it belonged: in Data Extractor, as data rather than as a live system. The members' pool metadata was parsed directly, the slab maps recovered, and each virtual disk reassembled offline from its scattered pieces — with his one excellent past decision paying out in full: mirrored resiliency meant every slab existed twice across the membership, so wherever the troubled metadata or an unclean shutdown had left one copy suspect, its twin stood ready, chosen sector by sector. Both virtual disks rose complete; the ReFS volumes on them parsed cleanly — the filesystem's own integrity streams confirming the contents they described — and his data was extracted, verified, and delivered on plain storage that no future upgrade can hold hostage.

Outcome

Full recovery of both virtual disks — from a pool whose official remedy was amnesia. For the growing tribe running Storage Spaces at home: it earns the respect you'd give a RAID card, because that's what it is. When a pool misbehaves, stop attaching the members — every parse attempt is live surgery — and know that "reinstall" addresses the operating system, never the pool's own damaged records. His mirror setting was the decision that made this recovery comfortable rather than forensic; anyone running simple (non-resilient) spaces should hear that clearly, and anyone migrating a pool between machines or Windows versions should let a full backup precede the move. Pools are portable in theory. His case is what theory's bad day looks like.

Our case files are drawn from genuine enquiries received by our laboratory over the past ten years, anonymised to protect client confidentiality. Each one describes the diagnostic and recovery procedure our engineers apply to that fault, using the equipment listed.