The straight answer: If your RAID or NAS reports degraded, critical, failed disk or an incomplete rebuild and the data matters, do not blindly initiate another rebuild. Stop all writes, document the drive order, take screenshots of the messages and shut the array down safely. Professional recovery does not begin by rebuilding the array using the original drives, but by sector-level cloning of each disk and offline reconstruction from copies.

Photorealistic illustrative scene of data recovery from a RAID array, drives removed from the array lying on an antistatic mat in front of a server
A photorealistic illustrative scene: with a failed RAID array, the drive order, the state of each medium and working only with clones are decisive. The original disks are not subjected to further stress after acquisition.

One click. 160 TB of capacity. Four years of company projects. And an administrative decision that seemed like a routine task at first glance: replace a faulty disk and initiate a rebuild.

That is exactly how a 20-drive RAID 6 array from a Brno-based design firm came to us. The NAS held CAD documentation, historical projects and some operational backups. In principle, RAID 6 is a dual-parity array, so it should survive the failure of two drives. Yet „should„ does not mean „it is safe to rebuild an old array without checking it first".

Real 20-drive RAID/NAS array in the ITHOPE laboratory during data recovery after a failed rebuild
A specific 20-drive RAID/NAS case from our laboratory. With a failed array, the goal is not to "try once more", but to get each drive reading under controlled conditions and assemble the array solely from clones.

What a Degraded RAID Means

The degraded state does not mean the data is lost. It means the RAID has lost part of its redundancy and is running in emergency mode.

  • RAID 1: one mirrored drive is missing; the data is on the other.
  • RAID 5: one drive is missing; an additional error can already mean losing the array.
  • RAID 6: one or two drives are missing, but with two failures there is no room for another error.
  • RAID 10: it depends on which mirror pair has lost a drive.

The biggest mistake is to treat a degraded state as an automatic call for an immediate rebuild at all costs. For a small, new array with a fresh backup, this may be reasonable. For a NAS that has been running for four years with tens of terabytes and no verified offsite backup, it is a gamble.

Failure Timeline

Our case involved an enterprise NAS with 20 drives in RAID 6. The array had been running nonstop for several years. Users had active projects as well as archives on it.

Monday morning: drive number 7 failed. The array transitioned to a degraded state, but the data remained accessible. The administrator ordered a replacement drive and planned an evening swap.

Tuesday morning: before the replacement drive even arrived, disk number 12 reported a critical error. RAID 6 was theoretically still readable, yet now with zero tolerance for any further errors.

Tuesday afternoon: the replacement drive arrived and a rebuild was started. The controller began reading the entire surface of the remaining drives, recalculating parity and writing a fresh copy of the missing data.

Thirty hours later: the rebuild halted on bad sectors on drive number 5. Previously, that drive had appeared healthy. However, the intensive read activity during the rebuild uncovered latent errors that were invisible under normal operation.

Wednesday morning: the array was offline and could not be mounted using standard means.

This is the exact moment when another rebuild attempt, a „force online" command, changing the drive order or initialising a new array can destroy even what is still recoverable.

Why a Rebuild Can Finish off an Old Array

A rebuild is not data repair. A rebuild is a massive stress test for all remaining drives.

During normal operation, a NAS reads only active files and metadata. During a rebuild, the controller must traverse a substantial portion of every drive’s surface, often for hours or days on end. With older drives, it is exactly then that the following emerge:

  • latent bad sectors,
  • read timeouts,
  • weak heads,
  • worsened SMART values,
  • power or cooling issues in the bay,
  • parity inconsistencies from previous outages.

The larger the drives, the longer the rebuild and the wider the risk window. With RAID 5, the problem is even more acute, because one additional error during the rebuild can mean total failure. RAID 6 has a larger safety margin, but not an infinite one. If two drives are already gone and a third starts returning errors, dual-parity protection no longer suffices.

What Should Have Come Before the Rebuild

The safe procedure for an important degraded RAID looks different:

  1. Stop all writes. Ideally, disconnect shared folders, shut down services, stop virtualisation and databases.
  2. Record the state. Screenshots of the NAS administration, logs, drive order, serial numbers, slots, RAID type, stripe size, filesystem type.
  3. Check the SMART of all disks. Not just the one the NAS has flagged as faulty.
  4. Verify the backup. Not „it should be somewhere", but actually opening the latest backup and checking the data.
  5. For critical data, clone before rebuilding. Read each original drive sector-by-sector to another medium. Only rebuild from copies or after a clear risk assessment.

If you are unsure, the safest step is not to overwrite anything further. This applies to Synology, QNAP, TrueNAS, Linux mdadm, ZFS and Dell/HP/LSI hardware controllers alike.

How We Proceeded in the Laboratory

Upon receipt, we first labelled the drives according to their original positions. With RAID recovery, the order is critical. Drives are not mixed up, automatic initialisation is not run and the „repair" offer in the administration interface is not accepted.

The first phase was sector-level cloning of all drives. Faulty drives are read using a different strategy than healthy ones: first the stable areas, then the worse spots, with reverse-direction reads and repeated attempts over weak sectors as needed. The goal is not a tidy SMART report. The goal is to obtain as many readable sectors as possible before the drive deteriorates further.

Anonymised RAID layout reconstruction in a laboratory tool with a hex editor and virtual array configuration
An example of RAID layout reconstruction in a laboratory tool. For a failed array, the drive order, offset, stripe size and parity are verified outside the original NAS.

The second phase was offline analysis. For large arrays, knowing „it was RAID 6" is not enough. We need the exact geometry:

  • drive order,
  • stripe size,
  • parity rotation,
  • start offset,
  • any NAS manufacturer metadata,
  • the state of the filesystem on top of the array.

Only then is a virtual array assembled from the clones. By that stage, we no longer want to stress the originals. If reconstruction fails on the first attempt, parameters are adjusted on the copies, not on the client’s disks.

Anonymised directory tree of recovered files in PC-3000 after successful analysis and data extraction
Only after the array is assembled from clones do we check the file system and data structure. Sensitive names are blurred in the example.

In this case, we successfully recovered 100 % of the client’s data. The client verified randomly selected CAD projects from several years, reference files and archive folders. We extracted the current Priority A projects before the rest of the array, so the firm could continue working while the full reconstruction ran.

A more detailed technical case study is available on the recovery from a 20-drive RAID 6 NAS page.

What to Do When Your RAID Reports an Error Right Now

If you are reading this article at a moment when your NAS is beeping or the administration panel is showing red:

  1. Do not restart the rebuild repeatedly. One failed rebuild is sufficient warning.
  2. Do not create a new array on the same disks. Initialisation can overwrite metadata.
  3. Do not change the drive order. Photograph the bays, write down the slots and serial numbers.
  4. Leave the array without writes. Every new file complicates the filesystem state.
  5. Do not combine advice from forums. mdadm, ZFS, Synology SHR, QNAP LVM and hardware RAID have different metadata structures.
  6. If a backup exists, verify it. Opening files is better than simply seeing the backup job „completed successfully".

If the data is something you cannot afford to lose, stop before taking any action that writes to the disks. Data recovery is most successful when the original state has not yet been overwritten.

RAID Is Not a Backup

RAID addresses availability. Backup addresses getting your data back after a catastrophe.

RAID can keep you going when a single drive fails and you need to continue working. It will not protect you against folder deletion, ransomware, administrator error, a faulty controller, fire, water damage or a rebuild failure. That is why, for business data, a combination makes sense:

  • RAID/NAS for operational availability,
  • regular scrub or patrol read,
  • SMART and temperature monitoring,
  • offline or offsite backup,
  • a restore test, at a minimum for critical folders.

If your NAS is the only place your data lives, it is not a backup. It is a single copy in a more expensive box.

Quick FAQ

My Synology/QNAP is in a degraded state. Should I insert a new disk?

First, verify the condition of all drives and your backup. If the data is important and the array is older, it is safer to consult the procedure before rebuilding. Inserting a disk often automatically initiates a process that is hard to easily roll back.

The rebuild is already running. Should I stop it?

It depends on the status. If it runs without errors and you have a verified backup, it may complete safely. If you see read errors, timeouts, another failed disk or unusual noises, further load can cause harm. In such a situation, it is better to stop writes, document the state and address cloning.

Will ddrescue help at home?

For a single drive, ddrescue can be a useful tool if you know what you are doing and you read onto another medium. For RAID, however, it is not enough to clone „something". You need the correct drive order, offset, parity and filesystem. An incorrect procedure can overwrite metadata or worsen the condition of the drives.

How much does RAID data recovery cost?

It depends on the number of drives, capacity, RAID type, media condition and the amount of manual reconstruction required. RAID/NAS diagnostics are free-of-charge with us, and you receive an estimate before the actual recovery begins. It makes sense to start via the RAID data recovery enquiry or the contact page.

If you have a degraded RAID, a failed rebuild or an offline NAS, do not attempt further blind repairs. Call +420 775 556 063, write to zachranadat@ithope.cz or send a description via contact. Our lab is located in Brno-Židenice; we handle RAID/NAS cases from all over the Czech Republic.