Home > Ask the Security Experts > Platform Security Questions & Answers > Will one failed drive corrupt the rest of a RAID-5 array?
Ask The Security Expert: Questions & Answers
EMAIL THIS

Will one failed drive corrupt the rest of a RAID-5 array?

Michael Cobb EXPERT RESPONSE FROM: Michael Cobb

Pose a Question
Other Security Categories
Meet all Security Experts
Become an Expert for this site


Digg This!    StumbleUpon Toolbar StumbleUpon    Bookmark with Delicious Del.icio.us   


>
QUESTION POSED ON: 17 October 2007
In a RAID-5 array, is it ever okay to place one failed drive online? Will it corrupt other drives since the failed one could potentially write corrupted data to the others?

>
EXPERT RESPONSE
The answer to your question depends very much on which type of RAID-5 hardware or software you are using and whether you have pre-configured it to support the "hot swap" of a failed drive.

A hot swap is the replacement of a hard drive, while the computer system using it remains in operation, or as you state in your question, online. With hot swapping, the RAID controller makes the drive appear to the computer's bus or I/O controller as still being there, despite being removed and replaced with another drive. The illusion is usually implemented using hardware, and it's unlikely that you can perform a hot swap of a failed disk if you are using a software-based RAID controller.

You will have to check your vendor's help manual, and if you are still not sure, then call them. Hot swapping is a sensitive, complex process, one that could ruin the rest of your RAID disks if you are not careful. Hot swap disks must be removed and inserted with caution, and they should be protected against static or physical shock throughout the entire process.

A RAID-5 volume, or storage unit, has a calculated value that can be used to reconstruct data after a failure. RAID-5 provides good fault tolerance, but it is not a cheap storage option. You need to buy an extra drive, because space is taken up storing parity data. If you use three 10 GB disks to create a RAID-5 volume, for example, the volume will only have a 20 GB capacity, as the remaining 10 GB are used for parity, which will allow the reconstruction of data.

Write performance is also reduced by the parity calculation, requiring three times more memory than a read operation. RAID-5 tends to be used where data integrity and data input/output speeds are important and are primarily read-oriented. So file, application, database and Web servers generally benefit from using RAID-5. RAID-1 is a better choice for systems running accounting or financial applications, which may require high availability due to greater write speeds.

If your particular setup allows, I would recommend setting up spare drives in your RAID-5 configuration. Spare drives are pre-installed disks that do not take part in the RAID set until one of the active drives fail. When a drive failure is detected, that drive is marked as bad, and reconstruction is immediately started on the first available spare drive without interrupting service. By rebuilding the array onto the empty drive, all redundancy is preserved, and the system can still operate despite the faulty drive.

Finally you need to treat your failed drive with the same care that you would any other data drive. This should involve destroying it according to your security policy. Depending on how files have been distributed across the drives in your RAID array, a low-level disk reader could be able to read all or some segments of your files.

More information:

  • Learn more about what should be done with a RAID-5 array's failed drives.
  • Michael Cobb explains how to enforce a data destruction policy.


  • Digg This!    StumbleUpon Toolbar StumbleUpon    Bookmark with Delicious Del.icio.us   


    RELATED CONTENT
    Platform Security
    How can 'DRAM remanence' compromise encryption keys?
    Should users have a removable boot drive for online banking?
    The unexpected costs of server virtualization?
    Is attack code valuable for vulnerabilities or just a publicity stunt?
    Will the features of Windows Vista SP1 encourage wider adoption of the OS?
    Is a Master Boot Record (MBR) rootkit completely invisible to the OS?
    What are the pros and cons of zero-knowledge penetration tests?
    Are open recursive DNS servers inherently insecure?
    Should whole disk encryption products be used with data backup software?
    Which operating system can best secure an FTP site?

    Enterprise Data Protection
    Sophos to acquire mobile data protection company Utimaco
    Should users have a removable boot drive for online banking?
    Unified communications trigger data leakage dangers, survey finds
    NitroSecurity covers its bases with RippleTech deal
    Easing e-discovery preparation by mapping enterprise data
    Quiz:: E-discovery and security in the enterprise
    Growing Mac use prompts call for better security
    Web 2.0 and e-discovery: Risks and countermeasures
    Screencast: Recovering lost data with WinHex
    Countermeasures against targeted attacks in the enterprise

    Data Backup
    Should users have a removable boot drive for online banking?
    Should whole disk encryption products be used with data backup software?
    The Craft of System Security
    Can confidential data be accessed once it is deleted for free space?
    Examining DoD-level secure erasure guidelines
    What is the relationship between open port range and overall security risk?
    Compliance, data breaches heighten database security needs
    Are encryption products better than self-destructing data?
    What is a logic bomb?
    What should be done with a RAID-5 array's failed drives?

    RELATED GLOSSARY TERMS
    Terms from Whatis.com − the technology online dictionary
    cut-and-paste attack  (SearchSecurity.com)
    data splitting  (SearchSecurity.com)
    deperimeterization  (SearchSecurity.com)
    Google hacking  (SearchSecurity.com)
    masquerade  (SearchSecurity.com)
    snooping  (SearchSecurity.com)

    RELATED RESOURCES
    2020software.com, trial software downloads for accounting software, ERP software, CRM software and business software systems
    Search Bitpipe.com for the latest white papers and business webcasts
    Whatis.com, the online computer dictionary



    Search and Browse the Expert Answer Center
    Search and browse more than 25,000 question and answer pairs from more than 250 TechTarget industry experts.
    Browse our Expert Advice



    Find Security Solutions for Your Business
    Targeted Security Channel Tips for Resellers, Integrators and Consultants
    TechTarget Security Media
    Information Security View this month\\'s issue and subscribe today.
    Information Security Decisions Apply online for free conference admission.
    SearchSecurity.com
    HomeNewsMagazineMultimediaWhite PapersLearningAdviceTopicsEventsAbout Us

    About Us  |  Contact Us  |  For Advertisers  |  For Business Partners  |  Site Index  |  RSS
    TechTarget provides enterprise IT professionals with the information they need to perform their jobs - from developing strategy, to making cost-effective IT purchase decisions and managing their organizations' IT projects - with its network of technology-specific Web sites, events and magazines.

    TechTarget Corporate Web Site  |  Media Kits  |  Reprints  |  Site Map




    All Rights Reserved, Copyright 2003 - 2008, TechTarget | Read our Privacy Policy
      TechTarget - The IT Media ROI Experts