A mirror will protect you from one event: a disk dying. However, a mirror does not protect you from a delete, a file system corruption, a ransomware attack, or a rebuild initiated on a disk which is already failing, because when anything occurs above the level of the RAID array, what occurs to your data on one drive occurs to your data on the second drive as well. Parity arrays fail differently again — see RAID 5 data recovery for the rebuild-window problem.
If either drive can't read the sector in question the other frequently can. Essentially, we are taking both images and creating one complete image — not rebuilding onto a replacement while the remaining disk is under load.
Your data is being protected, however the amount of protection provided by a RAID 1 configuration is more limited than most users perceive.
For RAID 1 data writes are duplicated on both drives and each drive has an independent and identical replica of all data that is stored on the volume. If one drive fails, you will lose no time because the remaining drive contains a full replica of your data. This is genuinely valuable and that is the total extent of the protection.
Redundancy doesn't protect you from things happening on top of your data. Redundancy will mirror all deletions as they happen in real time, mirroring all corruptions of files, ransomware encryption runs, and even an accidental format. It's a redundant duplication process that mirrors the damage.
The key to remembering the difference between redundancy and backups is: redundancy protects against hardware issues. Only backups protect against people and software issues.
A sample of mirrored drives that reach us.
Most of the time, when there are two disks in a mirror, they're probably going to be the exact same model, purchased at the same time, performing the same tasks since day one. As such, they wear at the same rate and the second failure often follows the first by weeks.
Classic. A member of your RAID array dies. You replace it with a new one and then rebuild the entire array using that old dying survivor as well. The rebuild estimate should give you an indication of how bad things are. Hours is normal, but days mean the source cannot be read.
A write gets to one member but not the other so the two copies disagree. This is known as silent divergence and you won't know about it unless there's been a scrub done after the error has occurred. If you put together a complete array without doing a scrub, it may be built from the incorrect side.
Both sides reflect changes immediately. No RAID level helps here. That's why snapshots and off-device backups exist.
That is the technical explanation as to why a mirror performs reasonably well during recovery if both members of the mirror array are damaged.
Two disks in a failing mirrored setup will rarely fail in the same places. A sector that cannot be read from Disk1 can frequently be read perfectly fine from Disk2; the "bad" sectors are typically independent of one another.
Both disks are therefore imaged — including one the controller has already marked failed, and including one needing donor heads first. The two images are then combined using the information provided within each to fill-in missing areas. If there is disagreement over what should be written into a given area, the version with more internal consistency will be selected based upon verification against existing structures within the file systems instead of making arbitrary decisions.
This is generally the difference between recovering some and nearly all of your data. It's why shipping just the 'good' disk is a false economy.
In order.
While a degraded mirror may still serve files, the window of opportunity during which you can recover the greatest amount of data without spending money closes without notice.
Rebuilding a two-disk mirror RAID is a simple copy operation. Therefore rebuild times are normally measured in hours. Rebuilds that take days or longer indicate that the good disk cannot read data quickly enough either; therefore the good disk is also failing, and as such the rebuild will run it at maximum stress throughout.
When there are two copies available, there are two chances at each sector being readable, which regularly takes a result from partial to complete.
Yes. Against one disk failure, redundancy does work. No. Against user error, data corruption, ransomware, or accidental formatting — these types occur at levels higher than a RAID array and are identical to both drives. Thus redundancy protects against hardware failures while only backups can protect against everything else.
No. It would take many hours for a few terabytes on good disks to be copied. An estimate in days indicates that the source can't be read at speed, which means the good disk is failing as well.
They are generally the same model, purchased at the same time, and since that time performed the exact amount of duty. Therefore, they will deteriorate at an equal rate; therefore, the second failure frequently follows the first within weeks.
Yes. Each disk rarely fails in the same location; thus, a sector which cannot be read off one disk can often still be read from the other. Merging both images together regularly takes a result from a partial image to an almost complete one.
This occurs when the write was successful to one member but failed to reach the other. Rather than selecting a random member to use, the more internally consistent version is selected by testing against the file system’s own structures.
From £500 plus VAT after a free 48-hour diagnosis. A 50% deposit is required if either member of the set requires physical drive-level work.