One disk from each pair
Entirely survivable. Each pair still has a working member, the volume stays online, and performance drops slightly. On an eight-disk array you can theoretically lose four disks this way.
Fine
It is built as mirrored pairs with striping across them, so whether a second failure is survivable depends entirely on which disk it is. Lose one from each pair and you are fine. Lose both from one pair and the whole volume goes.
Disks pair off into mirrors, and data is striped across the pairs. You give up half the raw capacity and get quick writes and failure behaviour that is easy to reason about.
The order of construction is what determines everything about its behaviour.
A RAID 10 with four disks is two mirrored pairs — disks one and two hold identical data, disks three and four hold identical data — and the volume is then striped across those two pairs. Every write goes to both halves of whichever pair it lands on.
That gives you the write performance of striping with the redundancy of mirroring, which is why it is the default choice for databases and busy virtual machine hosts. It also means you are paying for half your raw capacity in redundancy: eight 4TB disks give you 16TB usable, not 28TB as RAID 5 would.
The important structural point: redundancy exists within pairs, not across the array. There is no parity spanning the set, so a pair that loses both members has nothing anywhere else to reconstruct from.
The same number of failures produces completely different outcomes.
Entirely survivable. Each pair still has a working member, the volume stays online, and performance drops slightly. On an eight-disk array you can theoretically lose four disks this way.
Total loss of the volume. That pair held the only copies of its stripes and nothing else in the array can compute them back.
The dangerous window. Rebuilding a pair reads the survivor completely, and if that member was also degraded it can fail under the load — taking the pair with it.
Deletion, corruption, ransomware. Duplicated to both members of every pair instantly. RAID 10 offers no protection at all here.
Which is the practical danger, and it is a consequence of the design working well.
A RAID 5 that loses a member becomes noticeably slower, because every read of the missing disk’s data has to be computed from parity across all the others. People notice.
A RAID 10 that loses a member simply reads from the other half of that pair. There is no computation, no measurable slowdown, and nothing a user would perceive. The array carries on at essentially full speed with a pair reduced to one disk and no margin left in it.
So RAID 10 arrays reach us having run degraded for months, because nothing prompted anyone to look. If you run one, the alerting matters more than it does on any other level — there is no performance symptom to fall back on.
The reconstruction follows the construction, in reverse.
A disk the controller ejected frequently still holds most of its data, and in a mirrored pair it may be the only source for whatever its partner cannot read.
Which disks mirror each other is derived by comparing images directly — mirrored members hold identical content at identical offsets, which is unmistakable within a few megabytes.
Stripe size, order and offset established by testing candidates until file system structures resolve coherently.
The volume is reconstructed from the images outside the hardware, and the file system repaired from its own backup structures.
It depends which ones. One disk from each mirrored pair is survivable — on an eight-disk array that is theoretically four. Both disks from the same pair means total loss, because nothing else in the array holds those stripes.
For rebuild risk, considerably. Rebuilding a RAID 10 pair only reads its partner rather than every disk in the array, so the load is far lower. You pay for that in capacity — half your raw storage goes to redundancy.
Because RAID 10 gives no performance symptom when a disk fails — it simply reads from the other half of the pair, with no computation and no measurable slowdown. Alerting matters more here than on any other level.
No. Deletion, corruption and ransomware happen above the array and are duplicated to both members of every pair instantly. Only snapshots and off-device backups protect against those.
Only by recovering the physical disks in that pair — there is no parity elsewhere to compute their stripes from. Both members are imaged, including any the controller ejected, and merged to fill each other’s gaps.
From £500 plus VAT after a free 48-hour diagnostic, with a 50% deposit where members need physical drive-level work. Send every disk, labelled by bay where you know the order.