Double disk failure of RAID 5, and all patient data is gone.

Feb 20, 2020

The Situation

An Italian manufacturer of medical devices experienced the simultaneous failure of two hard drives in a RAID5 system, losing highly sensitive files that were urgently needed.

Without access to the missing data, the company faced potential lawsuits from their clients. Knowing the recovery of the data on the RAID 5 could not be successfully completed without an expert, the client reached out to Ontrack for assistance.

Two hard drives in an EMC NX4 SAN system based on a RAID 5 hard disk array failed simultaneously, leading to an inconsistency of the system files.

The company decided to fix this situation by installing two new hard drives into the system. Their IT department knew how to setup the RAID system, but while preparing the data restoration they noticed that the backup of several SAN drives was missing. Even in cases such as this, it is still possible to restore the system’s latest configuration status, but only if the four most important configuration files are accessible. Unfortunately, the company had set up the system internally and never saved or stored the respective configuration files. They also had not used the manufacturer’s support services, so even EMC couldn’t help. Important patient data, such as MRI scans that was stored for hospitals, became inaccessible.

The Solution

The client sent all the hard drives to Ontrack to mechanically repair the drives, image the data, and then create a 1:1 copy of the content on Ontrack’s servers.

There were a total of 43 LUN’s on the 48 hard drives. Luckily, the client was able to name the two LUNs that contained the important patient data so they could be accurately searched for fragments of both LUNs, as well as file-links within the system’s tables. The search was conducted using Ontrack’s proprietary tools combined with manual search by our data recovery engineers.

The Resolution

► More than three million DICOM files, image files of MRI scans, could be rescued from the two critical LUNs.

The first LUN contained 1.46 million files and the second LUN 1.78 million files. Finding and reassembling the fragments was not easy. Fourteen days of highly complex data recovery experience had to be invested in each of the two volumes. The effort paid off for the medical equipment producer as the critical data was recovered allowing patient treatments to move forward.