© 2010 - 2026 SouthBit Data Recovery, Studio 109, Palmyra Junction, 9 Palmyra Road, Claremont, 7708, 021 205 1119
Professional RAID & Server Data Recovery South Africa
Although most of our time is spent performing data recovery on individual hard drives, we also get requests for RAID data recovery from failed server or NAS devices where the hard drives are put into a RAID array. For small units usually RAID 0 or RAID 1 is used, for bigger units RAID 5 is the most commonly used setup. For this particular recovery, the client had 4x 8TB Seagate hard drives in RAID 6. The actual hard drives themselves were in good working order, but the array had been lost due to malicious activity when the unit was apparently hacked.
The first step was to investigate the actual contents of each drive using a hex editor which allows us to basically read the ‘ones and zeroes’ of the drive. By doing this we can compare the data on each drive and establish the parameters that were used to configure the RAID array. Below is an example of what the data would look like when viewing it in a hex editor.
Once we have established how the hard drives were put together to form the RAID array, we can configure a virtual data recovery environment with the parameters that we found and mount the RAID virtually and start to access the storage array. Here you can see that the array consisted of a ZFS filesystem and, within that, the actual data was hosted using a 13TB ReFS3 partition.
Now that we have uncovered the data structure we can start extracting the data. An issue with this particular recovery was the use of the ZFS filesystem. When mounted virtually, it is hugely resource-heavy. Even with an incredibly powerful machine sporting 128GB of DDR4 RAM, the memory usage was constantly maxed out and a pagefile was needed to work with this setup.
All in all, after a few days, the data was fully processed and recovered in our Cape Town data recovery lab. if you have any RAID data recoveries that you need assistant with, don’t hesitate to contact us.
Quick Answer
RAID data recovery involves reconstructing data from a failed or degraded multi-drive array by imaging each member drive independently through write-blocked channels, then reconstructing the stripe pattern, parity data, and filesystem structure offline — without writing anything to the original drives. At SouthBit, we use the PC-3000 UDMA and DeepSpar Disk Imager to handle this process across all major RAID levels and NAS platforms. Free 24-hour written assessment. No fix, no fee.
Supported RAID Configurations
We recover data from all common RAID levels — from simple 2-drive home setups to large rack-mounted enterprise servers. Below is an overview of each configuration and the specific challenges it presents for recovery.
RAID 0 — Striped Array
Data is written in alternating blocks (stripes) across two or more drives simultaneously. This delivers excellent read/write performance, but there is zero redundancy — if a single drive fails, the entire array goes offline and all data becomes inaccessible. RAID 0 is commonly used in workstations and gaming rigs where speed is prioritised over data safety. Recovery requires that every member drive be successfully imaged; even one unreadable drive makes reconstruction significantly more complex.
RAID 1 — Mirrored Array
All data is written identically to two drives at the same time, creating a real-time mirror. This provides good redundancy — if one drive fails, the other continues operating. However, RAID 1 is not a substitute for a proper backup: it does not protect against accidental deletion, malware, or controller failure. Recovery from a degraded RAID 1 is usually straightforward if at least one drive is mechanically sound. Split-brain scenarios — where both drives contain conflicting data — require careful analysis before reconstruction.
RAID 5 — Single-Parity Striping
One of the most widely deployed RAID configurations in small business and NAS environments. Data is striped across three or more drives, with parity information distributed across all members. A single drive failure is tolerable — the array continues functioning in a degraded state. The critical danger is what happens next: attempting a rebuild on a second weakening drive forces every sector of every remaining drive to be read. If another drive fails during that rebuild, the array crosses its parity threshold and all data is lost. We image each member independently before any reconstruction begins.
RAID 6 — Dual-Parity Striping
An extension of RAID 5 that adds a second, independent parity block, allowing the array to survive the simultaneous failure of two drives. Common in larger NAS units and mid-range enterprise storage where capacity is high and the risk of multiple drive failures during a rebuild is significant. Recovery from a RAID 6 with two failed drives requires imaging both members and determining the correct parity rotation before reconstruction can proceed. We have performed successful recoveries from RAID 6 arrays where both failed drives required physical intervention before imaging was possible.
RAID 10 (0+1) — Striped Mirror
Combines the speed of RAID 0 striping with the redundancy of RAID 1 mirroring. Requires a minimum of four drives. Data is striped across mirrored pairs, meaning the array can survive multiple drive failures as long as they do not both occur in the same mirror pair. RAID 10 is common in database servers and environments where both performance and reliability are critical. Recovery depends heavily on which mirror pairs failed and whether the surviving mirror in each pair is mechanically sound.
RAID 50
A nested level that stripes data across multiple RAID 5 sub-arrays. Each sub-array maintains its own parity, and the spans are striped together for performance. Recovery requires identifying the span configuration, reconstructing each sub-array independently, and then reassembling the stripe across spans. Common in mid-range enterprise storage with 6+ drives.
RAID 60
Stripes across multiple RAID 6 sub-arrays, providing dual-parity protection within each span. Typically found in larger enterprise environments with 8 or more drives. The most complex RAID level to reconstruct — recovery requires multi-span dual-parity calculations and careful parameter detection across all member images before any assembly is attempted.
Supported NAS, SAN & Enterprise Server Hardware
We work with all major NAS platforms and enterprise server hardware. In most cases you only need to send the drives — not the entire chassis.
NAS Devices
Synology — DiskStation & RackStation, DSM volumes, Btrfs and EXT4
QNAP — TS and TES series, QTS and QuTS Hero (ZFS), RAID and JBOD
Buffalo — LinkStation and TeraStation, mdadm software RAID
Netgear ReadyNAS — X-RAID and Flex-RAID configurations
Drobo — proprietary BeyondRAID with variable redundancy
Enterprise Servers
Dell PowerEdge — PERC H730, H740, H730P hardware RAID controllers
HP ProLiant — Smart Array P440ar, P408i-a, and legacy controllers
IBM xSeries — ServeRAID controllers and Storwize arrays
Cisco UCS — VIC-managed storage and SAN-attached volumes
Linux mdadm / ZFS / Btrfs — software RAID on any custom-built server
Filesystems Supported
EXT4 / EXT3 — standard Linux filesystem used by most NAS devices
ZFS — QNAP QuTS Hero, TrueNAS, Proxmox; resource-intensive to reconstruct
Btrfs — Synology DSM 7+
NTFS / ReFS — Windows-based RAID and Storage Spaces
XFS — enterprise Linux server environments
Warning Signs: When Your RAID Array Needs Professional Recovery
The single most important rule with any RAID failure is to stop all write activity and avoid forced rebuilds or reinitialisations. Every prompted action your NAS or server controller suggests — repair, reinitialise, rebuild, format — can overwrite the data you are trying to recover. Power down first and contact us before taking any further action.
| Symptom | Likely Cause | What To Do |
|---|---|---|
| Array shows "Degraded" | One member drive has failed or dropped from the array | Do not initiate a rebuild. Power down and contact us. |
| "Volume Crashed" / "Storage Pool Degraded" | Multiple member failures or metadata corruption — common on Synology and QNAP | Do not accept prompts to reinitialise, format, or recreate the volume. |
| Rebuild started and failed mid-way | A second drive failed during the rebuild, crossing the parity threshold | Power down immediately. Partial overwrite can sometimes still be salvaged. |
| Clicking or slow member drives | Mechanical head failure on one or more member drives | Do not power-cycle. Each restart risks further platter damage. |
| Array "Uninitialized" in Windows Disk Management | Controller metadata lost or RAID parameters corrupted | Do not click "Initialize Disk" — this destroys partition superblocks. |
| Shared folders inaccessible on NAS | Filesystem corruption, failed volume mount, or encryption key mismatch | Stop writing to the NAS. Note any encryption keys before contacting us. |
| Array offline after power outage or ransomware | Filesystem metadata corrupted by sudden power loss, or data encrypted by malware | Do not run chkdsk or fsck. Preserve drives in current state. |
Why RAID Recovery Requires a Specialist Lab
RAID recovery is not a job for standard IT support or consumer recovery software. Attempting it without the right tools makes the situation substantially worse — sometimes unrecoverably so.
The Multi-Drive Challenge
A RAID 5 array that loses two drives is completely offline. Before any reconstruction can begin, both drives must be stabilised and individually imaged through write-blocked channels. If either drive has a mechanical fault, it must be repaired in a HEPA-filtered cleanroom before imaging. Reconstruction only begins once every member is safely cloned — and it is performed entirely offline, from the cloned images, never from the original drives.
The Software Recovery Trap
Consumer RAID recovery software assumes all member drives are mechanically sound. If a drive has a degraded head stack, the block-by-block scanning these tools perform will drag failing heads across the platter surface — permanently destroying the magnetic coating. The correct approach is forensic-grade imaging hardware with conservative retry settings, which works around problematic sectors without causing further damage.
Tools & Credentials
Nick Parsons (BCom IS Honours, Computer Forensics, UCT) uses the PC-3000 UDMA and DeepSpar Disk Imager — professional hardware tools unavailable to general IT repair shops. PC-3000 enables firmware-level repair of individual member drives before imaging begins, and includes RAID Edition software for parameter detection and virtual array reconstruction from cloned images. All physical work is carried out on our HEPA-filtered cleanroom bench.
Our RAID Recovery Process
Every RAID recovery at SouthBit follows a strict image-first workflow. No experiments are run on original drives. No reconstruction is attempted until all members are safely cloned.
1. Free Written Assessment
We document your array configuration, member count, RAID level, NAS model, encryption status, and any prior rebuild attempts. You receive a written assessment within 24 hours with a clear cost estimate — no obligation to proceed.
2. Member Drive Stabilisation
Member drives with mechanical faults are assessed and repaired in our HEPA cleanroom before imaging begins. Head swaps and motor work are performed using matched donor parts. Electrically failed drives are diagnosed at board level and repaired where possible.
3. Write-Blocked Forensic Imaging
Each member drive is cloned independently using PC-3000 UDMA and DeepSpar Disk Imager. Write-blocking ensures original drives are never modified. Conservative retry settings allow data extraction from unstable sectors without causing further degradation.
4. RAID Parameter Detection
We capture RAID headers, superblocks, and controller metadata from the cloned images — recording stripe size, parity rotation, member order, and filesystem type. For proprietary controllers (Dell PERC, HP Smart Array), metadata is parsed directly from reserved sectors without the original controller hardware.
5. Offline Array Reconstruction
The virtual array is assembled from cloned images only — never from original drives. Parity consistency and filesystem integrity are validated across the reconstructed volume. Priority data such as shared folders, virtual machines, and databases is extracted first.
6. Delivery
Recovered data is copied to a new drive and returned via courier, or collected in person from our Claremont lab. We verify file integrity before handover. Payment by EFT or international bank transfer. No fix, no fee.
Data Security & POPIA Compliance for South African Businesses
SouthBit Data Recovery operates as a Responsible Party under the Protection of Personal Information Act (POPIA). All RAID and server recovery work is performed in-house at our Claremont, Cape Town lab — it is never outsourced to third parties, subcontractors, or overseas facilities. This means 100% data sovereignty within South Africa throughout the entire recovery process.
We maintain strict chain-of-custody from intake through delivery. For corporate and enterprise clients who require it, we are happy to discuss confidentiality arrangements prior to any work commencing. All working copies of your data are securely purged on request once recovery is confirmed.
Frequently Asked Questions
Can you recover data from a RAID 5 with two failed drives?
As long as we are able to get a good recovery from one of the failed drives, then recovery of the RAID 5 should be successful. We assess each case individually and will give you an honest picture during the free evaluation.
Do I need to send the entire NAS or server chassis?
Usually not. For most software RAID implementations (Linux mdadm, ZFS, Btrfs), the array geometry is stored in on-disk metadata on each member drive — physical slot positions are not strictly required for recovery. We recommend labelling your drives by slot number before removal. The chassis is only needed if your device uses hardware-level on-device encryption that cannot be decoupled from the enclosure. If you are unsure, contact us before shipping anything.
My IT company started a rebuild and it failed halfway. Is recovery still possible?
Often, yes — though the situation is more complex. A failed rebuild means the controller was writing parity recalculations back to sectors on the surviving drives. The extent of overwriting depends on how far the rebuild progressed before aborting. In many cases, enough original data remains that offline reconstruction from write-blocked images still produces a complete or near-complete result. Power the array down now and avoid any further repair or rebuild attempts.
What is the typical turnaround time for RAID recovery?
Small arrays of 2–4 member drives where all drives read cleanly: typically a few days. Larger arrays, or cases requiring cleanroom head swaps on multiple drives: allow one to three weeks. Donor part sourcing for physically damaged drives can also affect timing. We provide a realistic estimate during the assessment stage — we do not quote turnaround times we cannot meet.
Can you recover a Synology or QNAP NAS that says "Volume Crashed"?
Yes — this is one of the most common RAID scenarios we handle. "Volume Crashed" on Synology or "Storage Pool Degraded/Crashed" on QNAP typically means the array has lost enough members to fall below its fault tolerance, or that filesystem metadata has become corrupted. We image each member with write-blocking, capture the RAID and filesystem metadata, and reconstruct the array offline. The critical thing: do not accept any NAS prompts to repair, reinitialise, or recreate the volume — these overwrite partition superblocks.
I am based in Johannesburg, Pretoria, or Durban. Can I still use SouthBit?
Absolutely. We serve clients nationwide via courier. Drives are shipped to our Claremont, Cape Town lab, recovery is performed in-house, and your data is returned to you on a new drive via courier. The process works identically whether you are in Johannesburg, Pretoria, Durban, or anywhere else in South Africa. Contact us first and we will advise on safe packaging for multiple large drives.
