Data Recovery Case File · NAS & Network Storage · The Scan Is Working Correctly
It Is Finding Everything, Including What Was Never Missing
His enquiry reports a result that feels like a malfunction and is not. Two large drives in a two-bay enclosure that both lost data: "I'm trying to recover using software but it's recovering few files that were already safely on the disk." A scan that returns files you already have is behaving exactly as designed — and the reason it is not returning the ones he wants has more to do with the enclosure than with the software.
| Media | Two 8TB drives in a two-bay enclosure, one configured as an array — content loss on both; consumer recovery software returning existing rather than missing content |
| Reported situation | Two large drives in a two-bay enclosure · data loss reported on both · consumer recovery software applied · software returning files already present and accessible · missing content not located · one unit configured in array mode |
| Fault class | Carving applied across an array volume without layout interpretation — existing content recovered; distributed content not reassembled |
| Equipment used | Array configuration determined from member metadata before any recovery · both members imaged individually write-blocked · volume assembled offline from images · recovery performed against the assembled volume rather than individual members · results reconciled against existing content |
The decode: what carving does, and why an array defeats it
What a recovery scan actually does: reads the device from beginning to end looking for the recognisable openings of file types — the distinctive first bytes of a photograph, a document, a video — and writes out whatever follows each one. It does not know what you lost. It finds files, and files you still have are files it finds.
So the result is correct and useless: the software located the content that is present and accessible, because that content is there to be located. Its failure to return the missing material is a separate matter entirely. Nothing is wrong with the tool, and buying a different one will produce the same output.
Why the enclosure is the real obstacle: a two-bay unit configured as an array distributes data across both drives — either alternating pieces for speed, or mirrored copies. Where data is distributed, no single drive contains a complete file. A scan run against one member finds only the pieces that happen to start on it, and reassembles nothing.
Why it nevertheless found something: small files that fit entirely within a single piece of the distribution will sit whole on one drive, and those come back. Larger files — which is most of what people care about — are split, and their fragments are unrecognisable individually. That is why the results skew towards small, unimportant items.
What has to happen instead: the array's layout is determined from the metadata each member carries — how the data was distributed, in what size pieces, and in what order. Both drives are imaged, the volume is reassembled from the copies, and recovery is performed against the assembled volume rather than against either drive. Only then does a scan see whole files.
Why the array must not be rebuilt or reconfigured to achieve that: enclosure utilities offer to recreate or repair an array, and recreating one writes fresh metadata over the record of how the original was arranged — which is the information the reassembly depends on.
What is worth establishing before anything: which of the two units is configured as an array and which is not, since the approach differs entirely. A single drive holding whole files is a straightforward case, and it is worth separating from the one that is not.
On the bench
Array configuration was determined from member metadata before any recovery — a scan reading a device end to end for recognisable file openings, which on a distributed volume finds only items small enough to sit whole on one member and reassembles nothing larger. Both members were imaged individually write-blocked, the volume assembled offline from the images, and recovery performed against the assembled volume rather than individual members. Results were reconciled against existing content.
The outcome
The array layout established from metadata, both members imaged and the volume assembled before any recovery was attempted against it. Free assessment, one fixed written figure including VAT; where a drive has to be opened, 50% of parts and labour is payable upfront with the balance only on success — otherwise no recovery, no fee. The decode: your software is working correctly. A scan looks for recognisable file openings and writes out what follows — it has no idea what you lost, so files you still have are files it finds. What defeats it is the array, because distributed data means no single drive holds a complete file.
Recovery software returning files you never lost
That result is the software working correctly, so don't buy a different one. A scan reads the device end to end looking for the recognisable first bytes of file types and writes out whatever follows — it has no idea what you're missing, so anything present is something it finds. What's stopping it from finding the rest is your enclosure: a two-bay unit configured as an array distributes data across both drives, and where data is distributed no single drive holds a complete file. Small items that fit inside one piece come back whole, which is why the results skew towards trivia. Don't let the enclosure recreate or repair the array — that overwrites the record of how it was arranged.
The array is the obstacle — call Guildford Data Recovery on 01483 901310; layout determined from member metadata, both members imaged individually, recovery performed against the assembled volume.
Request a quote online →
Our case files are drawn from genuine enquiries received by our laboratory over the past ten years, anonymised to protect client confidentiality. Each one describes the diagnostic and recovery procedure our engineers apply to that fault, using the equipment listed.