Case Studies

Dell PowerEdge | 7-Disk RAID 5 (Hot Spare) | Multiple Failed Rebuilds

Incident (client narrative, condensed):
A 7-disk RAID 5 with a hot spare degraded over a weekend. The controller initiated an automatic rebuild to the spare and appeared to complete. On reboot the array flagged another member as failed. Two subsequent administrator-initiated rebuilds (after drive swaps) failed at 78% and 6% respectively. The server would not boot. The array hosted a file share plus Microsoft Exchange and a CRM SQL Server instance.

Assessment

• Likely latent media defects and/or marginal heads on at least two members, compounded by rebuild stress and write-hole/parity drift introduced during repeated reshape/rebuild attempts.

• High risk of controller metadata divergence across members (post-failure writes, inconsistent event journals).

• Required actions: freeze topology, image all original members, reverse-engineer the true, last-consistent geometry (order, stripe size, parity rotation, start offsets), then rebuild virtually from images only before repairing file systems and application stores (EDB/MDF).

Work Performed

1. Forensic intake & preservation

   • Catalogued all 7 original members and 2 replacement disks provided.

   • Logged controller NVRAM, slot map, and any foreign/learned configs.

   • Powered no suspect disk repeatedly; moved immediately to read-only acquisition.

2. Disk triage & imaging

   • Per-member SMART/telemetry review identified two mechanically compromised drives (intermittent head stack).

   • Performed mechanical remediation on those members (donor component matching by model, micro-jog, head map; alignment and adaptive calibration), enabling stable read-back.

   • Imaged all seven original members using adaptive head-select cloning with ECC-aware retries and progressive block reduction. Achieved 100% logical coverage on the two previously failing units post-mechanical work; the remaining members imaged with sparse remapped regions documented in defect maps.

3. Virtual array reconstruction

   • Parsed on-disk metadata; derived stripe size, parity rotation (left-symmetric), member order, and offsets.

   • Identified post-incident divergence caused by successive rebuild attempts. Constructed a version map to select the last coherent timeline across members.

   • Executed virtual parity reconciliation to close write-hole regions; no writes to originals (images only).

   • Result: consistent block-device image of the logical volume.

4. File system & application recovery

   • Verified and repaired NTFS volumes (MFT/mirror, log replay).

   • Exchange: mounted recovered EDB stores; performed soft-repair and logical consistency checks; exported mailboxes to PST per client brief.

   • SQL Server: validated MDF/NDF/LDF; rebuilt transaction logs where required; attached databases in a lab SQL instance; scripted out verification queries; exported BAKs.

   • Recovered file share hierarchy with ACLs where intact.

Outcome

• Full data recovery. Turnaround: images within 8 hours, virtual RAID reconstruction and data extraction within 35–48 hours (critical-priority workflow).

• Deliverables: validated Exchange and SQL datasets + file share, accompanied by SHA-256 manifest and recovery report.

We always operate from forensic images, never from the original drives, to preserve evidence and enable repeatable workflows.

Incident (client narrative, condensed):
A graphics firm stored client assets on a 4-disk RAID 0 (striped) LinkStation. After weeks of intermittent crashes, the NAS failed to boot and displayed two red fault indicators. Vendor firmware reflash attempts were unsuccessful.

Assessment

• RAID 0 offers no redundancy; any single-member failure breaks the volume. Two members showed extensive bad sectors/weak bands.

• Objective: stabilise failing members long enough to obtain maximum image coverage, then reconstruct the striped volume on images, repair the file system, and extract assets.

Work Performed

1. Triage & controlled acquisition

   • Established per-disk health and created defect maps.

   • For the two degraded members, used adaptive imaging (head-select, time-boxed retries, thermal rest cycles, targeted re-reads on directory/metadata zones).

   • Achieved near-total image coverage with documented sparse gaps in non-critical regions; the two “healthy” members imaged cleanly.

2. Stripe reconstruction

   • Determined array parameters (block size, member order, start offsets) from superblocks and on-disk signatures.

   • Rebuilt the virtual RAID 0 from images; where unreadable chunks persisted, performed file-system-aware filling (accepting sparse holes only when content validation confirmed non-critical cache/temp areas).

3. File system & asset validation

   • Mounted and repaired the NAS’s user volumes (EXT4/XFS depending on model).

   • Verified creative assets:

     • Raster/vector files checked via magic signatures and full opens in lab applications.

     • Project archives (ZIP/RAR/7z/PSB/AI) validated by index and content tests; repaired central directories if required.

   • Produced a structured export with original paths and timestamps where available.

Outcome

• 100% logical recovery of client-designated assets on standard-priority service in ~72 hours.

• Report included a risk note on RAID 0 use for primary storage and hardening guidance (backups, SMART monitoring, scrubs, and retirement policy for aging disks).

Dual SanDisk SD Cards (16 GB) | Wedding Shoot | Cards Not Recognised Anywhere

Incident (client narrative, condensed):
After a wedding shoot, 2 of 4 SD cards would not mount on macOS, Windows, the camera, or retail recovery tools.

Assessment

• Symptoms consistent with controller/FTL failure at the card level rather than simple file-system corruption: no enumeration, no stable read.

• Required chip-off methodology with NAND-level reconstruction.

Work Performed

1. Non-destructive checks

   • Confirmed no stable device ID under multiple readers/voltages/modes; ruled out simple exFAT damage. Proceeded to physical extraction.

2. Chip-off acquisition

   • De-soldered NAND packages from the monolith PCBs.

   • Read raw dumps from each die/plane including spare/OOB areas using a professional flash programmer.

3. NAND/FTL reconstruction

   • Identified page/block geometry, interleave, wear-leveling patterns, and the ECC (BCH/LDPC) scheme.

   • Removed XOR/scrambling; corrected ECC; rebuilt the Flash Translation Layer from translation pages and journal structures present in OOB.

   • Emitted coherent logical images of both cards’ exFAT volumes.

4. Photo/Video recovery & validation

   • Parsed directory trees; for orphaned files, carved by format (RAW/JPEG/HEIF/MP4/MOV) with header/footer and structure checks.

   • Rebuilt damaged MP4/MOV indices by regenerating moov atoms from mdat streams (SPS/PPS/VPS analysis) to ensure full playability.

   • Delivered complete galleries; provided hash manifest and a brief on chain-of-custody.

Outcome

• Full recovery from both cards. Photographer received validated, viewable sets suitable for editing with original capture timestamps preserved where possible.