A Namur accounting firm of 38 staff contacts us on a Friday afternoon: their main server, a Dell PowerEdge with a 6-disk, 4 TB RAID 5 array, won't boot. The night before, a power cut followed by a surge hit the server room. On restart, the PERC H730 controller shows three disks in a "Foreign" state and refuses to mount the volume. The entire accounting system — 22 TB of client data, ledgers and archives — is inaccessible. In the middle of closing season, every day of downtime costs thousands of euros.
The context: why 3 "Foreign" disks is a trap
A RAID 5 tolerates the loss of one disk: distributed parity then lets the missing data be reconstructed. With three disks flagged failed, the natural reflex — relaunching an automatic rebuild from the controller — would have been catastrophic: it would have overwritten the metadata of the still-healthy disks and made recovery impossible. This is mistake number one on a degraded RAID.
Our first instruction on the phone was therefore unambiguous: power the server off and relaunch nothing. The server reached us that same evening. The free diagnosis revealed that the three disks weren't actually dead: the surge had corrupted the electronics of two of them and scrambled the configuration metadata of the third. The platters were intact — the prognosis turned favorable.
The intervention, step by step
1 · Minimal electronic repair
Two disks needed to be brought back to life before any read. We replaced their printed circuit board (PCB) with a transfer of the original ROM — essential, since that memory holds the adaptive parameters unique to each drive. Without that transfer, a "repaired" drive produces only unreadable data.
2 · Forensic cloning of all 6 disks
Each member disk was then cloned sector by sector to an image, using hardware imagers and write blockers. From that point, no operation touched the physical disks: all work was done on the copies. Difficult zones were read first on healthy sectors, then retried over several passes for the stubborn ones.
3 · Virtual reconstruction of the array
The heart of the operation. Without trusting the failed controller, we manually determined the array's real parameters by analyzing the entropy of the data: stripe size, the exact disk order, the parity rotation scheme and the initial offset. RAID 5 parity is computed by an XOR operation between data blocks; by reversing that computation, we virtually reconstruct the missing block of any disk, without needing the corresponding physical disk.
4 · File-system extraction
Once the volume was virtually rebuilt, we mounted the file system read-only and verified the integrity of the accounting databases and archives. The VeriFiles list — the full inventory of recoverable files — was sent to the client for approval before any billing.
The result
The full 22 TB was recovered and returned on a new encrypted device. The firm resumed operations in under 48 hours of the server's arrival — closing season preserved. Fee: €2,700 excl. VAT (€700 excl. per member disk handled), billed only after approval of the file list.
This case illustrates three principles that guide every RAID operation at Dafotec: never work on the original disks, never relaunch an automatic rebuild before diagnosis, and understand that the data almost always survives the controller's failure. The challenge isn't to "repair" disks, but to reconstruct the array's logic.