Data Recovery Case File · NAS & Network Storage · The Window Between Failures

An Array Missing One Member Is Running Without the Protection It Was Bought For

His enquiry describes the failure mode this kind of array is most often lost to. A four-bay unit in a parity configuration where "one drive failed, I ordered a replacement, and by the time I came to install it a second drive failed" — leaving too few members to rebuild. The days between the first failure and the replacement arriving were days with no redundancy at all, and that interval is where these arrays are usually lost.

The decode: why the interval is the danger, and what can still be done

What single parity provides: the ability to lose one member and continue. Information is distributed so that any one drive's contents can be reconstructed from the others — which is genuine protection and is exactly what he had.

What it does not provide: protection against losing two. Once one member is gone the array is running with no margin at all, and a second failure means the missing information cannot be reconstructed from what remains.

Why the interval between failure and replacement is so exposed: during it, the array continues operating in a degraded state. Every read is being satisfied by reconstructing the missing member's contents from the others, which means the surviving drives are working harder than usual precisely when there is no spare capacity for one to fail.

Why the second failure is not the coincidence it appears: members are bought together, installed together, and have run identical hours in the same enclosure at the same temperature. They age at the same rate and reach the end of their working lives at about the same time — so one failing is a signal that the others are close.

Why waiting for a replacement to arrive is the common shape of this: ordering a drive takes days. The array is at its most vulnerable during exactly the period when nothing can be done about it, which is why keeping a spare on hand matters more than it seems.

Why the situation is not necessarily hopeless: the second drive has failed, and failed is not the same as unreadable. If most of the second member can be recovered, the array can be reconstructed for the regions where it returns data — parity fills in the first member throughout, and the second member's own contents are needed only where it cannot be read.

Why that makes the second drive the priority: its recoverable extent determines the outcome. Every region it yields is a region where the whole array can be reconstructed, and imaging it as completely as possible is the substance of the work.

Why the first drive is worth assessing too: it failed earlier and may be more readable than assumed. Two partially readable members can complement each other, with regions unreadable on one recovered from the other.

Why nothing is done in the unit: the array is assembled offline from images, with parameters derived from the members themselves. The unit's own configuration cannot be trusted after a double failure, and any rebuild it attempts writes across members.

What must not happen: no attempting a rebuild, no reinserting drives in different bays, and no initialising the array. A rebuild started with the wrong assumptions writes over the very members the reconstruction depends on.

On the bench

Each member was assessed and imaged individually before any assembly attempt — single parity permitting reconstruction of any one member from the others, so a degraded array satisfies reads by reconstruction and works surviving members harder while no margin remains, with common purchase and identical operating hours making near-simultaneous failure likely. Failed members were imaged under capped timeouts to maximise recoverable extent, and the array assembled offline from images with parity applied across surviving regions.

The outcome

Each member imaged individually, array parameters derived from the members, and the array assembled offline with parity applied across surviving regions. Free assessment, one fixed written figure including VAT, charged per drive, with 50% of parts and labour upfront and the balance only on successful recovery. The decode: this is not necessarily hopeless. Parity fills in the first member throughout, so the second member's own contents are needed only where it cannot be read — which makes its recoverable extent the thing that decides the outcome.

Our case files are drawn from genuine enquiries received by our laboratory over the past ten years, anonymised to protect client confidentiality. Each one describes the diagnostic and recovery procedure our engineers apply to that fault, using the equipment listed.