Server and virtual machine data recovery

This page covers server data recovery for organizations whose work stops when one box stops. Usually that is a rack or tower server with a RAID card, running Windows Server, Linux, or a hypervisor with several virtual machines on top. Sometimes it is an older machine nobody has touched in years until it fails.

You don’t need a large IT department to use us. Business data recovery starts with a phone call from whoever is on hand, an office manager or an outside IT contractor. We have done this work since 1991, and the lab is ISO 9001 certified.

• Offices running a shared file server, accounting database or domain controller.
• Medical practices with imaging, records or practice-management data on a local server.
• Legal firms with document management systems and case files on a RAID volume.
• Contractors and engineering firms with plans, CAD files and job archives on a NAS or server.
• IT providers who look after any of the above and need a lab for enterprise data recovery.

RAID controller failure. The card dies, loses its configuration, or marks healthy disks as foreign after a firmware update or power event. The data is usually still on the members. The risk is someone importing, initializing or rebuilding the set to get it back online. Dell PERC, HP Smart Array, LSI/Broadcom and Adaptec cards store their metadata differently, but the first step is the same: clone every member, then map stripe size, disk order and parity position from the clones. Guessing the layout on live disks adds writes.

VMDK and VHDX corruption. A VMware datastore or Hyper-V volume goes missing, or a single virtual machine won’t boot. Snapshot chains break, thin disks run out of space, or a LUN disappears after a failover. We assemble the array from clones first, then check the virtual disks, then the filesystems inside them. A volume that mounts but is missing its VMs is not a finished job.

Filesystem damage. ReFS, NTFS, ext4 and XFS volumes can fail after a crash, a bad shutdown or a repair attempt. Running a repair tool on the original disks writes to them. We work on images instead, and verify the filesystem on the assembled image rather than by booting the original controller. Linux software RAID and Windows Storage Spaces get the same treatment.

Ransomware. We don’t decrypt ransomware and we won’t promise that anyone can. What we can do is examine the disks for data the attack did not reach, such as older or unencrypted copies. Results depend on how far the encryption got and how long the system kept running. Disconnect the server from the network, but don’t wipe or reinstall it.

What to do and not do in the first hour:

• Do power the server down and leave it off.
• Do label every disk with its bay number, or photograph the bays before you pull anything.
• Do send every member, including disks the controller marked failed. Parity lives across the set.
• Don’t start a rebuild, and stop one that is running. A rebuild is the heaviest read a weak disk will ever do.
• Don’t run chkdsk, fsck or any repair tool on a member disk or a degraded volume.
• Don’t present the disks to a new controller, NAS or SAN. A new controller may initialize them as unused capacity.
• Don’t restore a backup onto the original disks. Restore to different hardware.

On-site diagnostics are available. Call us for details or to arrange a visit.

Recovery itself is done in our Columbia, MD lab.

Servers hold payroll, patient records, client files and contracts. We treat them that way. Medical and legal clients, and anyone else who needs it, can request a written chain-of-custody record when the disks come in.

• Written chain-of-custody on request, from intake to return.
• Recovered files are returned on new media.
• We don’t keep copies of your data longer than needed to confirm delivery.
• We only clone and read the disks. We don’t write to your originals.

A down server is a business outage. Call the 24/7 emergency line at (410) 937-7332 and tell us the RAID level if you know it, how many disks, which bays failed, whether a rebuild started, and whether the server held virtual machines. Form enquiries get a reply within one business day.

Bring the disks to our Columbia lab at 10015 Old Columbia Rd, Suite B 215, Columbia, MD 21046, weekdays 8:30 a.m. to 5:00 p.m. You can also ship the disks to us free both ways. Pickup is available too; call or use the form for details.

Once all disks arrive, RAID and physical jobs usually take 3–7 days. The evaluation is free. You get a fixed quote before any paid work, and if we can’t recover the data you need, you don’t pay the recovery fee. Over 15,000 cases recovered, with a 95% success rate.

What affects the cost →