Recovery of RAID5 and RAID0 Data from Windows Disk Management and Server Manager (WSS)
-
Author:
Vladimir Artiukh
-
Editor:
Oleg Afonin
In this article we will examine how to perform data recovery from software RAID 5 and RAID 0 created using the Windows Storage Spaces and Windows Disk Management tools in Windows Server 2012. You will learn how to quickly restore access to information if the server fails, one of the drives malfunctions, or the operating system stops recognizing the RAID array. We will review common failure scenarios and demonstrate effective data recovery methods in environments where arrays are used for critical tasks: database storage, server services, or virtualization platforms.
Storage systems based on Windows Disk Management and Windows Server Manager are widely used to create software RAID arrays in Windows environments. The most common configurations remain RAID 0 and RAID 5, which provide either increased performance or fault tolerance depending on the array type.
However, even reliable RAID configurations do not guarantee complete protection against data loss. Causes of problems may include drive failures, corruption of RAID service metadata, user errors, operating system failures, or incorrect migration of the array between servers. In such situations access to information may be lost both in Windows and after connecting the disks to another system.
Particular attention should be paid to the possibility of recovering such arrays in an Ubuntu environment, which provides a wide set of tools for disk analysis, working with RAID, and filesystem recovery. Thanks to support for Linux utilities and specialized software, it is possible to reconstruct the RAID structure, gain access to lost partitions, and recover important files.
This article describes how to recover data from RAID0 and RAID5 arrays created in Windows Disk Management and Server Manager using Ubuntu, and outlines the features and risks to consider during the recovery procedure.
RAID 5/0 Data Recovery from Windows Disk Management and Server Manager on Ubuntu
Methods of creating RAID
In Windows Server 2012 there are two different mechanisms for creating disk arrays:
- The first is implemented through Windows Storage Spaces in the Server Manager environment.
- The second uses the classic Windows Disk Management tool.
These technologies perform a similar task, but operate on different principles.
| Characteristic | Storage Spaces | Disk Management |
|---|---|---|
| Purpose | Modern storage virtualization system | Classic disk and RAID management |
| Availability | Windows 8 / Server 2012 and newer | In all modern versions of Windows |
| Technology type | Storage Pool + Virtual Disk | Dynamic Disk |
| RAID support | Simple, Mirror, Parity | RAID 0, RAID 1, RAID 5 |
| Scalability | Flexible pool expansion | Limited |
| Adding disks | Possible without system rebuild | Limited |
| Fault tolerance | Mirror, Parity | RAID 1, RAID 5 |
| Thin provisioning support | Yes | No |
| Data recovery | More complex due to storage metadata | Simpler |
| Compatibility with Linux | Limited | Better recognized |
| Primary use | Servers, large storage systems | Small RAID arrays |
Storage Spaces is a modern storage virtualization system. First you create a disk pool and add physical drives to it, then you create virtual disks inside that pool with the required level of resilience: Simple, Mirror, or Parity. This approach allows flexible capacity management, adding new drives without shutting down the server, and expanding storage without rebuilding the array.
Another feature of Storage Spaces is the use of metadata that is written across all disks in the pool. Because of this the system can automatically determine the storage configuration after the disks are reconnected to another server that supports this technology.
In contrast, Disk Management uses the dynamic disk technology. To create RAID arrays the system converts basic disks into the Dynamic Disk format. After that it is possible to create classic software RAID arrays, including RAID 0, RAID 1, and RAID 5.
In this case the array configuration information is stored in the service area of each dynamic disk. The array does not use a disk pool and is created directly from specific physical drives. Management of such a RAID is significantly simpler, but scalability is limited. Adding new disks or changing the array structure often requires rebuilding it or creating a new volume.
The resilience principle also differs. Storage Spaces uses a more flexible model of data distribution that can apply different redundancy levels within a single pool, creating multiple virtual disks with different parameters. In Disk Management each volume has a fixed RAID type which is defined during creation and cannot be changed later.
Thus, Storage Spaces in Windows Server 2012 is a more modern and flexible storage management technology aimed at scalable server systems. Disk Management, in turn, implements classic software RAID and is more often used in simpler configurations or small server environments.
ReFS file system
In the example described in this article we work with the ReFS (Resilient File System). This file system was developed by Microsoft specifically for high-load server environments and is focused on maximum resiliency.
The main feature of ReFS is the implementation of metadata integrity verification mechanisms and automatic self-healing functions without system downtime. Optimization for large data volumes and complex RAID arrays made it a standard for configurations based on Windows Server 2012.
It is important to note that despite the closed architecture of Microsoft, this article demonstrates the possibility of obtaining full access to such data even in a Linux environment. This enables professional analysis and RAID array recovery on any system regardless of the limitations of the native Windows ecosystem.
Data recovery
METHOD 1. Recovery of a WSS array
First we consider data recovery from a RAID 5 assembled from three disks in Windows Storage Spaces. The disks use the ReFS file system, and the recovery procedure will be performed on a computer running Ubuntu.
If server hardware fails, for example due to power supply, motherboard, or controller malfunction, reading the disks directly on the server may become impossible. In such cases the drives should be carefully removed from the server and connected to a workstation. This can be done directly via the SATA interface or using an external docking station.
Although the disks use the ReFS filesystem, which is intended for Windows, access to the data can be restored using Hetman RAID Recovery. The program analyzes Storage Spaces metadata, determines the array parameters, and automatically reconstructs its structure. After this it becomes possible to browse the directory tree and extract the required files, even if Linux does not support direct mounting of that filesystem.
METHOD 2. Using a disk image
If your workstation architecture does not allow connecting all disks simultaneously, the optimal solution is to use virtual images of the drives. This method involves creating exact bit-by-bit copies of each disk for subsequent analysis.
After mounting the image of the missing drive directly in the Hetman RAID Recovery interface, the program treats it as a full physical device. Working in combination with the other available disks, the utility automatically reconstructs the array structure. This approach allows starting the recovery process even when connection ports are limited, ensuring safety and integrity of the data at every stage.
METHOD 3. Automatic RAID 5 recovery
Immediately after launch, Hetman RAID Recovery initiates an automatic scan of connected drives. The program analyzes service information and attempts to reconstruct the original RAID configuration based on it. In the main window you will see a list of all detected physical disks as well as virtual arrays already assembled and ready for further work.
Select the detected RAID 5 and run the Fast scan mode.
After the scan completes, the main program window will display the full structure of the reconstructed RAID array with all files and folders. Mark the required files and folders and click the Recovery button.
In the next step specify the destination for the recovered data and confirm the action by clicking Recovery.
After completing all recovery steps the data from the RAID array will again be available for further use.
METHOD 4. Automatic RAID 0 recovery
In the second example we consider data recovery from a RAID 0 that was created from two disks in Windows Storage Spaces. The array uses the ReFS file system.
RAID 0 peculiarity is that data is distributed across all disks in the array without redundancy. Therefore, to recover data you must connect all disks simultaneously and work with the array as a single structure. Individual disks from such an array do not contain complete files, so a program cannot read them independently of each other.
Before starting, ensure that all disks that were part of the RAID 0 are physically connected to the computer. This can be done via the SATA interface directly to the motherboard or using an external docking station.
As in the previous case, recovery will be performed on a computer running Ubuntu, using Hetman RAID Recovery, which will determine the array parameters and reconstruct its structure for subsequent file access.
Launch Hetman RAID Recovery. The program will instantly analyze the connected hardware and automatically reconstruct the logical structure of your array. In the main window you will see both individual physical devices and the reconstructed RAID 0 ready for recovery.
Proceed to the Fast Scan item and start the analysis.
After the scan completes, the program will display the recovered structure of partitions, folders, and files. Using the preview window you can verify their contents and ensure the required data reads correctly.
Next, mark the required folders or individual files and click the Recovery button.
To save the results, specify another disk or external storage. It is important not to write recovered files back to the same media from which recovery is performed to avoid overwriting data.
METHOD 5. Recovery of a Disk Management array
Even with correct RAID configuration, arrays can lose access to data due to hardware failures or software errors.
In such situations it is important to act with maximum care: do not write new data to the array disks because this can overwrite fragments of lost information and complicate recovery.
Below we consider one of the most common scenarios of losing access to a RAID array. This situation can occur as a result of an operating system failure where the array configuration ceases to be recognized correctly by the system. It can also be caused by hardware malfunction of the server, after which the system can no longer detect all drives that belong to the array. In some cases the problem is caused by an unsuccessful firmware update of the controller or other system components. As a result the RAID array becomes inaccessible even if the drives themselves remain physically intact.
Before starting work close all applications that may use these drives and temporarily disable automatic backups.
If the array is not mounted by the system, do not initialize or format the disks or create new partitions; it is better to leave them in the state in which the system detects them and proceed directly to the recovery procedure.
METHOD 6. Automatic RAID 5 recovery
For demonstration we will use a RAID 5 created with the Windows Disk Management tool in Windows Server 2012. The array consists of four drives using the ReFS file system. In this example we will show how to restore access to data in case of system failure or corruption of the RAID configuration.
For recovery you can also use Hetman RAID Recovery.
Select our RAID 5 and run Fast Scan.
The program will automatically detect the ReFS file system, so additional configuration is usually not required.
After selecting the mode click Next to start the scanning process. Note that a full analysis can take a significant amount of time, especially if the array has a large capacity.
After the scan completes the main program window will display the detected partitions, directories, and files that were previously stored on the array and can be recovered.
If necessary you can use the Preview function to view file contents and verify their integrity.
Next, mark the required directories or individual files and start the recovery process by pressing the Recovery button.
In the next window specify the path to save the recovered data on another storage device and confirm the action by clicking Recovery again.
After the procedure completes the program will notify about successful recovery of data from your RAID array.
METHOD 7. Recovery in RAID Constructor
In the next example we consider a more complex scenario when one of the four drives in a RAID 5 has failed or when the array was accidentally formatted by the user.
In this case the program may not automatically detect the array structure, so it is recommended to use the RAID Constructor in manual mode to reconstruct the configuration.
After removing the drives from the server it is essential to record their original order in the RAID array before performing any recovery actions.
Each drive in RAID 5 has a defined position in the data and parity calculation sequence, so changing the drive order may result in incorrect assembly of the array, filesystem corruption, and significantly complicate recovery.
It is important to consider that RAID 5 allows data recovery even if one drive is missing, because information can be reconstructed using parity blocks.
In this configuration the physical start of a drive does not coincide with the actual start of the filesystem. Due to partial corruption or deletion of service data the program loses the necessary landmarks for automatic offset detection.
As a result the algorithm cannot accurately determine the zero sector of the logical partition. In this situation the offset value must be specified manually during array reconstruction. If this is not done the filesystem may be displayed incorrectly or remain unavailable for analysis and recovery.
An incorrectly set Offset can also lead to an incorrect directory structure display or missing files.
To determine the exact offset value use the built-in HEX editor.
If the order of drives in the RAID array is unknown, the search for the signature and calculation of the Offset must be performed individually for each drive in the array. This approach will allow establishing the correct offset for each device and ensure proper reconstruction of the entire configuration.
The ReFS filesystem has a unique signature located at the beginning of its service structures. However, in some ReFS structures the signature may not start strictly at the zero block but with a small offset inside the metadata structure. In hexadecimal representation it appears as the byte sequence 00 00 00 52 65 46 53 00, which in the editor’s text field corresponds to the string ReFS.
To activate the tool select the required disk and use the Ctrl + H key combination or the corresponding context menu item.
In the HEX editor window run the search function Find text or value and enter the hexadecimal sequence 00 00 00 52 65 46 53 00 into the appropriate field.
Be sure to switch the search mode to Search for HEX-value. For increased accuracy and faster analysis it is also recommended to select the Begin of sector option since the ReFS filesystem signature is located at the start of a sector.
After the editor finds the matching marker, place the cursor on the found position or view the address of the current block in the program interface. This will allow determining the exact offset value to use during further RAID reconstruction.
To increase result reliability it is also appropriate to ensure that the found signature indeed corresponds to the start of the filesystem service structures and is not a coincidental byte sequence within the data.
After you have found the Offset value, open the RAID Constructor tool and select Manual mode.
When manually creating the array you need to specify the primary parameters that were used during its formation: RAID type, block placement order, block size, and bytes per sector.
For RAID 5 the following values are typically used in most common configurations:
- Block order – Left synchronous,
- Block size – 64 KB,
- Bytes per sector – 512 bytes.
In the constructor window, in the Available disks field select the drives that belong to your RAID array and move them to the Selected disks field.
If one of the drives is physically missing or has failed, use the Add empty disk function which allows integrating a virtual empty disk into the array structure to simulate the missing component, preserving the integrity of the RAID 5 architecture and enabling successful data recovery.
To apply the calculated offset parameters double-click the required disk or use the Change disk offset/size icon. In the dialog that opens enter the obtained offset value – 264192 – in the Offset field.
Before confirmation change the units from Bytes to Sectors – this will avoid calculation errors since the program will automatically convert the specified number of sectors to bytes.
After clicking OK repeat this procedure for each drive that is part of your RAID array. Such precise configuration of each component is critical for block synchronization and correct reconstruction of the ReFS logical filesystem structure.
If the exact drive order is unknown it can be established manually by sequential trial. Change the positions of the drives in the Selected disks list by moving them up or down with the arrows, and after each change check whether a correct logical volume configuration is displayed in the lower part of the window. This approach allows visually controlling the array reconstruction process in real time and quickly assessing the correctness of the chosen order.
In addition, you can use the Detect the disk order automatically function which runs an automatic enumeration of all possible drive arrangements in the RAID array. Although this procedure can take more time depending on the number of drives in the configuration, it significantly reduces the probability of error and helps determine the correct disk order in complex storage structures.
After making changes click the Add button to add the reconstructed RAID array to the main program screen for further scanning and file recovery.
After the RAID array is correctly reconstructed in the RAID Constructor, scanning is performed and analysis results appear on the main program screen, press the Recovery button.
In the window that opens click Next, select the Save on hard disk option and specify the folder for saving. After the process completes you will be able to recover the required data by saving it to another disk.
Conclusion
Data recovery from RAID 0 and RAID 5 arrays created with Windows Disk Management or Windows Server Manager in an Ubuntu environment is entirely possible even after severe failures or loss of access to the array. Thanks to Linux tools and specialized software, it is possible to reconstruct the RAID structure, analyze disk configuration, and restore important files.
At the same time it should be taken into account that RAID0 has no redundancy, so damage to even a single drive can lead to critical data loss. RAID5 is more protected, however reconstruction errors, controller failures, or corruption of service data can also render the system inaccessible.
For successful recovery it is important not to write to the problematic disks, to correctly determine the array parameters, and to use safe analysis methods. The best results are achieved by creating images of the drives and working with copies of the data.
Thus, Ubuntu can be an effective platform for recovering Windows RAID arrays, especially in cases where native operating system tools no longer allow access to the data.
