Recovery of data from BitLocker-encrypted Parity and Simple RAID in Windows Server 2022
-
Author:
Vladimir Artiukh
-
Editor:
Oleg Afonin
In this article, we will examine how to recover data from software RAID 5 and RAID 0 arrays created in Server Manager through Storage Spaces on Windows Server 2022. You will learn how to quickly restore accidentally deleted files or regain access to mission-critical information if a server fails, a drive stops working, or the system no longer recognizes the array.
- WSS RAID Features
- Recovering Data from BitLocker-Encrypted Parity and Simple RAID Arrays
- Conclusion
- Frequently Asked Questions
- Comments
Storage Spaces in Windows Server 2022 allows you to combine physical drives into virtual storage pools with different data layout types, including Simple and Parity. Such configurations are used to improve performance, optimize disk capacity usage, and protect against the failure of individual drives. In addition, the contents of a virtual disk can be encrypted with BitLocker, providing protection against unauthorized access.
However, corruption of the Storage Spaces configuration, failure of one or more disks, accidental deletion of a virtual disk, or BitLocker issues can result in loss of access to important files. In such cases, standard Windows tools do not always allow you to restore the storage structure and access the data.
In this article, we will examine how to recover data from BitLocker-encrypted Simple and Parity storage spaces in Windows Server 2022, how to identify the array structure, what to do if Storage Spaces are damaged, and what conditions are required for successful decryption and file recovery. Special attention will be given to situations where access to the storage is lost, but the physical disks and part of the service information remain intact.
BitLocker Recovery: Deleted Files, Lost Partitions, and Damaged Drives
WSS RAID Features
In Windows Server 2022, software RAID creation is implemented through Storage Spaces in Server Manager.
This modern storage virtualization system operates on the pool-based principle. First, physical drives are combined into a common Storage Pool, and then virtual disks with the required fault tolerance level are created inside it, such as Simple or Parity arrays, which correspond to classic RAID 0 and RAID 5. This approach provides flexible capacity management and high scalability for server storage.
Another important parameter of virtual disks in Storage Spaces is the Provisioning type. The system offers two options: Thin and Fixed, which technical specialists often refer to as thick or Thick. The Fixed type reserves the full specified capacity on the physical drives immediately, whereas Thin allocates space dynamically as files are actually written.
In our review, we use both options: the Parity array was created with the fixed thick provisioning type, while the Simple array uses dynamic thin provisioning.
Regardless of the selected type, Hetman RAID Recovery algorithms detect both structures equally effectively.
An important detail is that both of our arrays are formatted with the modern ReFS (Resilient File System). The Hetman RAID Recovery program supports a huge number of file systems, including ReFS, so regardless of the selected provisioning type and architectural complexity, the algorithms detect their structure equally effectively.
The key feature of this technology is that the array configuration is stored as metadata on the drives themselves rather than in the operating system. This makes it easy to move disks between servers, but it also introduces risks. Any operating system failure or metadata corruption immediately breaks the pool, after which Windows displays the disks as unallocated. Restoring access with built-in tools becomes impossible, but Hetman RAID Recovery automatically scans sectors, finds remnants of Storage Spaces metadata, and virtually reconstructs the array for safe file recovery.
| Characteristic | Simple | Mirror | Parity |
|---|---|---|---|
| Number of disks | From 1 | From 2 | From 3 |
| Operating principle | Data distribution across disks without redundancy | Mirroring of data | Data distribution with parity |
| RAID equivalent | RAID 0 | RAID 1 / RAID 10 | RAID 5 |
| Protection against disk failure | No | Yes | Yes |
| Read performance | High | High | High |
| Write performance | High | High | Lower due to parity calculation |
| Disk space efficiency | High | Lower due to duplication | Higher than Mirror |
| Recovery after disk failure | Impossible without backup | Possible if a copy of the data is available | Possible if the required number of disks is preserved |
| Fault tolerance | 0 disks | Depends on the configuration | Usually 1 disk |
| Primary purpose | Performance and maximum space utilization | Reliability and data protection | Balance between capacity and protection |
| Risk of data loss | High if any disk fails | Low | Medium |
| Use for critical data | Not recommended without a backup | Recommended | Recommended |
| Recovery specifics | Data must be recovered from individual disks | The mirror copy can be used | The structure and parity parameters must be identified correctly |
| BitLocker encryption | Possible | Possible | Possible |
| Typical use case | Temporary data, cache, working files | Servers and critical data | File servers and large storage systems |
BitLocker Disk Encryption
Another important aspect is the use of BitLocker, which protects data by encrypting it at the sector level.
If the virtual disks in your array were encrypted, then in the event of loss of access to the pool, you will definitely need the 48-digit recovery password or a .bek key file.
Because the information is encrypted at the physical level, to successfully search for files with Hetman RAID Recovery, such a volume must first be unlocked directly in the program interface. Only after removing the protection can the algorithms analyze the logical structure and find all lost data.
Recovering Data from BitLocker-Encrypted Parity and Simple RAID Arrays
STEP 1. Connecting the Drives to the PC
Before starting the recovery process itself, you need to remove the drives from the problematic server and connect them to your workstation.
The best and most reliable method is to connect the drives directly to the motherboard via SATA ports or by using additional SAS or HBA expansion cards. This approach provides maximum data read speed and ensures stable operation during analysis.
It is also worth noting an important detail: since our test scenario uses a RAID 5 array as an example, you do not necessarily need to connect all drives to rebuild it successfully and recover the data completely. It is sufficient to connect only the minimum required number of working disks, and the program will automatically calculate the missing data using parity blocks.
STEP 2. Working with Disk Images
There are situations where it is physically impossible to connect all required drives at once due to a lack of free ports on the computer. In such cases, you can use the sector-by-sector image creation function. This is also a standard safety measure when working with disks that show signs of hardware failure or have bad sectors.
An image is an exact byte-for-byte copy of your physical disk, saved as a regular file on another storage device with sufficient capacity. You can connect the server drives one by one, create images from them, and then simply load all the resulting files into Hetman RAID Recovery. The program will work with them exactly the same as with real physical devices.
To create such an image, launch the program, select the required drive, and click the Save disk button on the top panel. Then simply specify the save location.
It is important to remember that the size of the resulting file will fully correspond to the total capacity of the source drive, regardless of how much data is stored on it. Make sure you have enough free space available.
After the saving process is complete, open the main menu and select Mount disk.
From the available options, select Raw disk images and open the files you just created.
They will immediately appear in the general list of available devices. The program is now fully ready to automatically reconstruct your array.
STEP 3. Automatic RAID Array Recovery
After all drives have been successfully connected to the workstation or their sector-by-sector images have been mounted, launch Hetman RAID Recovery. The program automatically analyzes the structures and instantly recognizes the Parity and Simple arrays created earlier.
Using our test bench as an example, we can see successful automatic reconstruction of the Parity software array even with one drive physically absent. This once again confirms that to fully recover the information, it is sufficient to connect the minimum required number of active disks, while the utility calculates the missing data independently based on parity blocks.
Since our test virtual disks were pre-encrypted with BitLocker, they must be unlocked in order to access the files. Here it is worth paying attention to an important technical nuance that explains why we do this specifically in the macOS environment.
If you connect the server disks to a regular computer running Windows and try to unlock the array using system tools, background processes will immediately create hidden folders and update metadata. This almost always leads to partial overwriting of the lost information. By working on a Mac and unlocking the volumes only within the safe environment of Hetman RAID Recovery, we completely avoid this risk.
The program supports three convenient decryption methods:
- entering a plain text password;
- using the 48-digit recovery key;
- loading a special .bek file.
In our example, we choose the simplest option and enter the password, after which the utility automatically removes the protection and opens access to the volume.
If you have already tried to open your problematic disks in Windows, the file structure may have changed. In that case, the basic Fast scan algorithm, which we are about to use, may be insufficient. You will need to run Full scan. This method performs a deep byte-by-byte scan and efficiently finds data by unique signatures even after partial overwriting.
Now, let us move on to the final stage. Click the assembled and unlocked array and start the Fast scan algorithm.
After the quick analysis, the program correctly recognizes the logical structure of the ReFS file system and displays all found data, fully preserving the original directory hierarchy for further safe recovery.
STEP 4. Recovering Deleted Files
Although the source data was created in a Windows Server environment, the program easily works with dozens of different file systems and successfully handles the specifics of our ReFS-based volume, so it correctly recognizes the original array structure.
In the results window, you will immediately see the entire file system with existing and deleted folders. Data that was lost before the critical array failure can be easily found in the list, as it is marked with a special red cross indicator.
Before recovery, you can evaluate the result in preview mode. The Preview function allows you to instantly open the contents of any document, photo, or database to verify its integrity.
To restore the found data, select the required items and click the Recovery button. In the window that appears, specify a safe location to save them.
Remember the main rule: to avoid data corruption, never save recovered files to the same RAID array from which you are working. After the copying process is complete, you will have full access to all recovered files in the specified directory.
Conclusion
Recovering data from BitLocker-encrypted Parity and Simple RAID arrays in Windows Server 2022 is a complex task, because it requires taking into account the Storage Spaces structure, the distribution of data across physical drives, and the BitLocker encryption mechanism at the same time. Simply connecting the disks to another computer does not always make it possible to access the files, especially if the virtual storage configuration was damaged or partially lost.
In the case of Simple, the absence of redundancy means that damage to or loss of one disk can lead to the loss of part or all of the data. For Parity, recovery options are higher, since part of the information can be reconstructed using parity data; however, this requires correct identification of the storage structure and data layout parameters.
If the data was encrypted with BitLocker, access to it requires a password, recovery key, or another valid unlocking method. Without the required key, recovering the contents of the encrypted volume is practically impossible.
The most important rule when access to such a storage system is lost is to avoid formatting, initialization, or recreating Storage Spaces. It is also advisable not to write new data to the disks. Before recovery, it is recommended to create byte-level copies of the drives and work with them to preserve the original data.
Thus, successful recovery depends on the condition of the physical disks, the preservation of Storage Spaces metadata, the RAID configuration type, the extent of the damage, and the availability of the BitLocker key. In complex cases, using specialized software for RAID/Storage Spaces analysis and data recovery can significantly increase the chances of restoring access to important files.
