RAID or NAS failure: why you should not start a rebuild or reinitialise the volume

In short: when a RAID or NAS (Synology, QNAP, a server with a RAID controller…) becomes inaccessible, the data is usually still on the drives. What puts it most at risk is what people do next: a rebuild with a drive that was no longer up to date, or creating a new volume on top of the old one. Switch the device off, leave everything as it is and take the drives to a lab.

Written after the workshop “RAID data recovery from A to Z” at ACE Lab TechWeek 2026 (Alicante, October 2026), presented by Alexander Leonenko, senior engineer and trainer at ACE Lab. ACE Lab makes the PC-3000 range, the reference equipment used by data recovery labs.

Typical symptoms

• The NAS reports a volume as “degraded”, “crashed” or “not initialised”.
• The RAID controller can no longer find the configuration or offers to create a new volume.
• One or more drives are flagged as failed or missing.
• A rebuild stopped partway through.
• The volume is accessible again, but some files will not open or are corrupted.

What does a RAID mean for your data?

In a RAID 0, 5 or 6, your files are not stored drive by drive. They are split into blocks spread across all the drives, along with check blocks (parity, calculated with an operation called XOR) that let the array survive the failure of one drive (RAID 5) or two (RAID 6).

To read the data back, you need to know the exact “recipe” of the array: which drives belong to the volume, in what order, the block size, the RAID level, where the data starts on each drive… During the workshop, Alexander Leonenko stressed one point: it is not enough to know that it is “a RAID 5”; you have to find the exact mapping between each block of the volume and its position on each drive.

Normally, these parameters are stored on the drives themselves (the metadata). That is why a NAS or controller can assemble the volume on its own. The trouble starts when this information is lost… or replaced with the wrong information.

Worth knowing: in Synology NAS units and most QNAP models, the RAID is not managed by a RAID card but by the NAS software, which is based on Linux (mdadm, LVM, SHR on Synology). Connected to a Windows computer, a NAS drive therefore looks unreadable, and Windows offers to initialise or format it. Do not accept under any circumstances: the data is still there, just in a format Windows cannot read.

What ACE Lab showed

The workshop presented the method used with the PC-3000 to reconstruct a RAID. The main message: RAID recovery is not “black magic”; it is a methodical engineering process, but not a linear one: when a hypothesis fails, you go back and test another. The main steps:

1. Diagnose each drive. The SMART data (power-on hours, identification, errors) already reveals a lot. An example given by the trainer: a customer usually buys identical drives at the same time; if one of them stands out from the rest, it was probably added later.
2. Try automatic detection based on the metadata. It is fast and reliable, but not always possible. And the result must always be checked: if the customer has reinitialised the volume, the metadata describes the new configuration, not the one where their files are.
3. Otherwise, work out the parameters from the data itself. The software runs a statistical analysis of the contents of each drive (the size of recognised files, the “entropy” of the sectors, meaning how disordered they are: parity blocks usually look more random) to deduce the block size, the number of drives and the RAID level. The drive order is then deduced from the position of known file system structures. The trainer showed that with a standard configuration, the choice narrows down very quickly to a handful of options.
4. Verify the configuration by checking a file large enough to be spread across all the drives: a small file only validates a few blocks, while a large one checks the position of all the blocks relative to each other.
5. Look for redundancy-related problems. This is where the traps described below are found.

The most dangerous mistakes

1. Rebuilding with an “outdated” drive

The typical scenario: a drive drops out of the RAID and nobody notices. The volume keeps running without it for days or months. That drive therefore holds an old version of the data. If it is added back in, or if the volume is rebuilt with it alongside the up-to-date drives, you end up with corrupted files: old and new blocks get mixed together.

The trainer stressed that this is a common problem that should be checked for systematically. In the lab, that drive has to be identified and the volume assembled without it.

2. Reinitialising or creating a new volume

When a NAS or controller no longer recognises the volume, it often offers to create a new one. If you accept, it calculates new parity blocks and writes them to the drives, over the existing data.

According to the trainer, this damage follows a regular pattern, which sometimes makes it possible to reconstruct it: you first have to check that enough redundancy is left to make up for what was overwritten, then identify the damage pattern (the configuration of the new volume) and assemble a repair configuration, which recalculates the overwritten blocks from the redundancy. But a RAID 5 can only reconstruct one block per stripe: if two blocks in the same stripe have been overwritten, that part is lost.

3. Writing new data to the volume

According to the trainer, this is the most serious case: once new data has been written to the sectors, the damage no longer follows any pattern. The damaged sectors then have to be pinpointed precisely, which is much harder, if not impossible. In practice, this happens for example after copying files, reinstalling a system or running a file system check on the damaged volume.

As the trainer summed it up: diagnosing these problems is reliable, but fixing them can be very difficult, and sometimes recovery is no longer possible.

What to do right away

Our advice from the lab:

1. Shut down the NAS or server properly, and do not switch it back on.
2. Do not start a rebuild, repair or check of the volume (rebuild, repair, chkdsk, fsck…).
3. Never agree to create or initialise a new volume, even if the interface suggests it. The same applies if you connect a NAS drive to a computer and Windows offers to initialise or format it.
4. Do not replace drives at random or change their order. If you need to take them out, number them according to their slot.
5. Write down the history: which drive failed and when, what has been tried, whether the volume was used in degraded mode, the model of the NAS or controller.
6. Bring all the drives, including the one that failed first.

How we work

At Belgium Data Recovery, this is how we handle RAID and NAS systems:

1. Free diagnosis of each drive, followed by a quote.
2. A copy of each drive; failing drives first go through a hardware intervention if needed (for example, replacing the head stack in a cleanroom).
3. Reconstructing the RAID configuration on the copies: the analysis no longer puts any strain on the original drives, which are often already fragile.
4. Verifying the configuration and checking for an outdated drive or an overwritten area.
5. Extracting your files, returned on a blank drive you provide, or on a Belgium Data Recovery drive at extra cost.

We work on a No Cure No Pay basis: if we cannot recover your data, you pay nothing. If you gave us a list of your important files and we recover less than 75 % of them, you can turn down the result at no cost.

See also: RAID data recovery · NAS data recovery · data recovery in Belgium