How to recover data from Btrfs RAID 0, RAID 5, and RAID 6 arrays created on Rockstor
-
Author:
Vladimir Artiukh
-
Editor:
Oleg Afonin
Read about data recovery from Btrfs RAID 0, 5 and 6 arrays created in the Rockstor 5.1 operating system based on OpenSUSE Leap. We will analyze scenarios of logical errors, including accidental file deletion via network protocols SMB/CIFS, NFS, SFTP, AFP, or cases where data has been severely corrupted. Special attention will be paid to hardware issues such as drive failures, server hardware or entire NAS failures, as well as Rockstor software faults after updates or accidental system-disk wipes.
- RockStor capabilities
- STEP 1. Connecting drives
- STEP 2. Automatic RAID detection
- STEP 3. Snapshot recovery
- Recovery after BTRFS Pool deletion
- Conclusion
- Questions and answers
- Comments
The Rockstor system is a popular Linux-based network storage solution that uses the Btrfs file system to provide flexible data management, snapshots and software RAID implementation. Thanks to support for RAID 0, RAID 5 and RAID 6, users can combine high performance, efficient disk space utilization and an increased level of data protection.
However, even modern technologies do not guarantee complete safety. Failure of one or more drives, corruption of the Btrfs structure, system update errors or incorrect administrator actions can lead to loss of access to important files. Recovery from RAID 5 and RAID 6 arrays is especially complex because these levels use parity mechanisms to reconstruct lost blocks.
Data Recovery from ZFS RAIDZ1, RAIDZ2, RAIDZ3, and Stripe Arrays
RockStor capabilities
Rockstor is an open network storage system based on Linux that uses the modern BTRFS file system as the basis for data management. The system is distributed free of charge and provides a convenient web interface for managing disks, volumes, snapshots and network file access. With support for SMB, NFS and SFTP protocols, Rockstor integrates easily into any network environment, both home and enterprise.
One of Rockstor’s key advantages is built-in RAID support at the BTRFS file system level, which allows creating RAID 0, 1, 5, 6 and 10 arrays without additional software.
The system supports creating real-time volume snapshots, which greatly simplifies backup and recovery after accidental changes.
In addition, Rockstor has a built-in plugin manager Rock-ons, which allows deploying additional services in Docker containers directly from the web interface, turning the system into a fully functional home or office server.
STEP 1. Connecting drives
Before starting data recovery, it is necessary to clearly understand how many drives from the array must be operational:
- For RAID 0 all drives are required without exception, because data is striped across them and loss of any drive makes the array completely unreadable.
- For RAID 5 it is sufficient to have all drives except one — the array tolerates the loss of one drive thanks to parity blocks.
- For RAID 6 up to two drives can be missing simultaneously, since this level uses double parity, making it the most resilient to hardware failures among the levels considered.
| Characteristic | RAID 0 | RAID 5 | RAID 6 |
|---|---|---|---|
| Minimum number of drives | 2 | 3 | 4 |
| Fault tolerance | None | 1 drive | 2 drives |
| Read performance | High | Medium | Medium |
| Write performance | High | Medium | Lower |
| Recovery complexity | High | Medium | High |
| Risk of data loss | High | Medium | Low |
It is also worth considering that drives which are formally recognized by the system as operational may have damaged sectors or read instability — in such cases, it is recommended to check each drive’s condition using S.M.A.R.T. indicators before recovery.
If the number of available drives is below the required minimum, software recovery becomes highly unlikely and requires contacting specialized laboratories, where hardware methods sometimes allow reading information even from physically damaged media.
Drives can be connected to a computer in several ways depending on available hardware. The simplest and most reliable option is connection via SATA directly to the motherboard, which provides maximum transfer speed and minimal latency during reads.
If the number of SATA ports on the motherboard is limited, a PCIe-to-SATA adapter can be used to connect four or more drives simultaneously.
For quick connection without opening the case, external USB docks or SATA-to-USB adapters are convenient, although this option is somewhat slower and can be critical when working with large volumes of data.
Regardless of the chosen connection method, ensure the operating system has recognized all drives before launching the recovery software.
An alternative method is working with disk images — this is especially relevant when physical drives are damaged or there is a risk of further degradation, since an image preserves an exact copy of the disk contents and allows unlimited work with it without any risk to the original.
Working with disk images is the safest approach. This becomes critically important when physical media have hardware defects or technical constraints prevent connecting all array components to a computer simultaneously.
An image is a byte-for-byte copy of the media saved as a file, so software perceives it as a real physical drive while you can operate on it without risk of final failure of the original hardware.
To create an image, run Hetman RAID Recovery and select the required drive from the list.
Click the Save disk button, then in the dialog that appears specify a convenient location for saving it.
When choosing a save location, make sure the target drive has enough free space because the image size will be identical to the full capacity of the source drive regardless of how much data it contains.
After successful saving, return to the Main Menu and click Mount disk.
From the list of available types choose Raw disk images and specify the path to your file.
The image will appear in the general list of devices along with other connected hardware.
If several drives are problematic, repeat this procedure for each of them separately.
Once all components are virtually present in the system, the program will automatically detect the RAID configuration and display its structure for further analysis and data retrieval.
STEP 2. Automatic RAID detection
Now we will cover the action plan from a complete halt of server hardware or failure of its internal components to damage of individual drives that are part of your RAID.
These types of failures are the most common cause of full data access loss, since the operating system stops seeing the logical volume. This list also includes situations with critical Rockstor boot errors, when standard access to the storage becomes impossible and working with the media requires connecting them directly to another computer bypassing the damaged operating system.
Equally common are logical user errors, such as accidental permanent deletion of files using Shift + Delete, which results in immediate data loss bypassing the OS recycle bin. Although such data may appear permanently destroyed at first glance, in most cases it can be successfully recovered using specialized software.
Recovery is based on the characteristics of the Btrfs file system, which after deletion only marks the corresponding blocks as free for writing while the actual data remains on the drives until overwritten by new files. Professional utilities can perform deep analysis of these memory regions, identify remnants of metadata and fully reconstruct the original data structure.
| Btrfs feature | Description |
|---|---|
| Copy-on-Write (CoW) | Data is written to a new location without overwriting existing blocks, increasing safety |
| Snapshots | Ability to quickly create point-in-time copies of the file system |
| Integrity checking | Use of checksums to detect corrupted data |
| Self-repair | Automatic correction of corrupted blocks when using RAID |
| Built-in RAID | Support for RAID 0, 1, 10, 5, 6 without a separate RAID controller |
| Data compression | Support for zlib, LZO, ZSTD algorithms to save space |
| Subvolumes | Creation of separate logical partitions within a single file system |
| Online expansion | Ability to add new drives without shutting down the system |
| Data balancing | Redistribution of data across devices for optimization |
| Deduplication | Reduction of duplicate identical data blocks |
| Large capacities | Support for very large volumes and files |
| Flexible management | Ability to change configuration without reformatting |
For recovery in such complex situations we will use Hetman RAID Recovery, which is specifically designed for automatic reconstruction of damaged arrays and file extraction even in the complete absence of the original controller.
It is important to note a BTRFS-specific detail: unlike classic hardware or software RAID arrays, all service metadata about the array structure is stored in the superblock of each disk individually. For successful reconstruction you need to attach to the computer the minimum number of drives required by your RAID configuration.
After the program automatically identifies and assembles the array, it will allow analysis to start even from a single selected drive within the pool. Thanks to metadata duplication in the Btrfs system, the utility can reconstruct the full picture of the RAID array regardless of which physical device you begin scanning from.
This operating principle applies equally to all array levels built on this file system: RAID 0, RAID 5 and RAID 6.
Immediately after launching Hetman RAID Recovery the program will automatically scan connected media and identify them as part of a single Btrfs structure, assembling the array bypassing standard Windows mechanisms.
Let us move to a practical demonstration of the recovery process after server hardware failure or Rockstor OS malfunction using an example of a three-disk RAID 5 array.
Note that for RAID 0 and RAID 6 the procedure remains fully identical, so the described steps are universal for all supported configurations.
After launching Hetman RAID Recovery the program will analyze all connected media and automatically reconstruct the array structure, displaying it on the main screen with the type, total size and file system indicated.
To start finding data, select any drive from the array and run the Fast scan mode. In this mode the program quickly scans the file system metadata and directories, detects lost items and evaluates their state.
After the scan completes, the main screen will display all array content available for recovery, and the preview function will allow verifying the integrity of found files.
To finish the process, select the required objects and click Recovery in the Main Menu.
In the dialog that opens, specify a safe save location on another healthy device and confirm. The program will preserve the original folder structure and file attributes completely, and after copying finishes simply press Finish — the recovered data will then be available for further use.
If the program failed to automatically detect the array or the Fast scan result is insufficient, use Full scan, which performs deeper scanning with the ability to manually specify the file systems used in the array.
STEP 3. Snapshot recovery
Special attention should be given to recovery using previously created snapshots. This feature is particularly useful when a full system rollback is impractical due to the risk of losing recent changes made after the snapshot was created.
Hetman RAID Recovery allows accessing a specific Snapshot selectively, restoring only necessary files or folders without affecting the current array state. Consider this capability with a practical example of recovering data from a RAID 0 array assembled from two drives.
To begin, run Fast scan; after it completes a separate element will appear in the pool hierarchy as a Snapshot folder.
Inside it contains a list of all available snapshots ordered by name and creation date, allowing quick selection of the required restore point.
By selecting the appropriate snapshot you gain full access to all objects recorded at that moment. To recover, simply copy the required items to another drive — the current working pool structure remains unchanged.
Recovery after BTRFS Pool deletion
In situations where information must be restored after accidental deletion of a Pool, Hetman RAID Recovery provides powerful tools for automatic array reconstruction.
Since Btrfs metadata about RAID 0 structure is duplicated on each device, the program can reproduce the logical connection between two drives even after the pool itself was deleted in the Rockstor interface.
Choice of analysis mode depends on the nature of the data loss: if the pool was deleted at the logical level, using Fast Scan is sufficient to quickly read surviving metadata and display the directory hierarchy. In more complex cases — for example, serious corruption of service tables or logical partition structure — use Full Scan. This mode performs a thorough byte-level signature search, enabling recovery even without file system service records.
After analysis completes you will be able to view both existing and deleted files and verify their integrity using the preview window.
To finalize the process, mark the required objects and click Recovery.
On the next step specify a target folder for saving, ensuring you select a separate physical device with sufficient free space. This is critical to prevent overwriting the original data that still remains on the array drives.
The program will display available space on the target drive and the size of selected files for verification, then perform copying with integrity checks in real time.
After pressing Finish all recovered data will be available in the usual form, fully ready for further use.
Conclusion
Data recovery from BTRFS RAID 0, RAID 5 and RAID 6 arrays created in Rockstor requires a careful approach and understanding of Btrfs file system specifics. Each RAID level has its own storage structure:
- RAID 0 provides maximum performance but no redundancy,
- RAID 5 allows surviving a single drive failure,
- and RAID 6 — surviving two drives failing simultaneously.
Recovery success depends on drive condition, correct determination of array parameters and absence of data overwrites after the failure. Therefore, after losing access to storage it is important not to rebuild the RAID without a backup, not to format drives and not to write new files to the damaged array.
Modern recovery software can analyze BTRFS structure, assemble the RAID automatically or manually and restore lost files even after serious failures. However, in complex cases when multiple drives are damaged or the file system’s service structure is severely corrupted, it is advisable to contact specialists.
Thus, even after a serious RAID failure in Rockstor the chances of successful data recovery remain high if actions are taken quickly, carefully and with the correct tools.
