Case study on data recovery from network attached storage job received and resolution.

Received drives with note saying Drive 1 has bad sectors and Drive 3 was dead.
Drive 3 was not dead, only slightly degraded. Drive 2 and 4 show common signs of static shock damage.
Drive 2 and 4 was modified outside of the RAID array and the RAID signature was erased.
Someone most likely clicked ‘Yes’ to the “Initialize Disk” prompt in disk management (Please DON’T do this).

Drive 1:
Problem: Slow to respond. Media heavily degraded. Lots of bad sectors.
Operations: Disable SMART sub programs. Adjust head calibration and read retry count. Clone to another drive (clone 93% complete).

Drive 2:
Problem: PCB on, no spin. PCB showing firmware start failed. Determined PCB motor controller damaged.
Operations: ROM programmed onto new PCB and tested OK.

Drive 3:
Problem: Minor media degradation.
Operations: Disabled SMART sub programs.

Drive 4:
Problem: PCB showing firmware start failed. Firmware code CRC failed.
Operations: Repaired damaged ROM segment and tested OK

RAID:
Problem: RAID meta data invalid. Drive 1’s bad sectors caused RAID alignment problems and slowness.
Operations:
Analysed existing RAID metadata and compared against data on drives and determined the decompiled metadata is not a valid configuration ( RAID5, Left Synchronous, 128k, Offset 1853, Order 1,2,3,4 )
Analysed RAID data. Correct Configuration is RAID5, Left Asynchronous, 128k block size, Offset 0, Order is 1,2,3,4.
NTFS Checksums valid, NTFS pointers are correct. File structure available.
Scanned for MFT entries and verified they were valid.
Large video file was pulled for data consistency check. Video checksum valid and video file contained no continuity errors.
File recovery started but Drive 1 was determined to be performing too poorly to continue.
Drive 1 cloned and File recovery restarted with clone in place of Drive 1.