RAID NVR Footage RecoveryDegraded Arrays, Failed Rebuilds and the Order of Operations That Saves the Footage
A sixteen-bay NVR with a red light on one drive is not a lost cause. It is an array running on parity with every recording still intact. What happens in the next hour decides whether it stays that way, and the step the recorder offers, Rebuild, is the one with the worst odds. This guide explains what Degraded means, why rebuilds fail on large surveillance drives and how a RAID NVR is recovered by imaging every member and reconstructing the array from the copies.
Footage on a failed or degraded RAID NVR is recoverable when every member drive is still readable, including any marked as failed. Image each drive first and never let the NVR rebuild or re-create the array. Reconstruct the array from the images using the drive order, stripe size and parity rotation the recorder used. The recorder's video layout then reads from the rebuilt array like a single drive. Rebuilding in place is how most RAID 5 arrays are lost.
RAID is standard on larger surveillance recorders: Hikvision's DS-9600 I series, Dahua's NVR6 and IVSS lines, Uniview's NVR308, NVR516 and NVR824, Hanwha's PRN and XRN B4 models and TVT's sixteen-bay TD-3364 all offer RAID 0, 1, 5, 6 and 10, with 50 and 60 on the larger chassis. The appeal is one failed drive without lost footage. The trap is the second failure, which on surveillance drives of eight terabytes and up arrives more often than the arithmetic suggests, and the NVR's own response to a failure is the thing most likely to turn a recoverable array into an unrecoverable one.
What does Degraded mean, and why is Rebuild the dangerous button?
Every vendor uses roughly the same vocabulary. Uniview arrays are Normal, Degraded, Damaged or Rebuild. Dahua's are Active, Degraded, InActive or Recovering. Hanwha's are Degraded or Fail, and Hanwha's note adds that Fail means the array can no longer be used or recovered by the NVR. Degraded is a RAID 5 or 6 array that has lost one drive and is running on parity, with every read now reconstructed from the surviving members. Hikvision's RAID bulletin describes a degraded RAID 5 as still recording, and all vendors offer a rebuild once a replacement drive is fitted, automatically where a hot spare is configured.
The rebuild reads every sector of every surviving drive to compute the missing one. On a four-drive array of 16 TB members that is 48 TB of reads under recording load, which installers report taking three to seven days on 12 TB drives and eleven days in one 14 TB case. Drive specifications allow one unrecoverable read error per 10^14 bits, roughly every 12.5 TB, so a rebuild of that size is expected to meet a sector it cannot read. One such sector can halt the rebuild, and a second drive failing during the days it runs takes the array with it. Gillware calls a failed rebuild of a degraded array the single most common cause of RAID 5 data loss it sees, and the 2007 FAST study by Schroeder and Gibson found field failure rates two to four times the datasheet figure and a second failure during reconstruction far more likely than the usual model predicts. Dahua's own guidance is that a second failure during recovery loses the data.
How is footage recovered from a failed RAID NVR?
- Power down and label. Switch the NVR off and label every drive with its bay number before a single one comes out. Photograph the chassis. Drive order is the first thing a reconstruction needs and the easiest to lose.
- Keep the failed member. The drive the NVR marked as failed is still a member. Gillware's rule is that recovery needs every member, including any that already failed, because a partly readable failed drive fills gaps the parity cannot.
- Image each drive, read only. Through a write blocker, create a sector-level image of every member as E01 or raw DD and hash it. A drive with bad sectors is imaged with a tool that skips and logs them rather than retried in the NVR. From this point no original drive is touched again.
- Reconstruct the array from the images. Determine the RAID level, the drive order, the stripe size, the parity rotation and any offset, then assemble a virtual array. A wrong drive order produces an array that looks whole and plays as noise, so the result is checked against the recorder's own structures.
- Read the recorder layout. DVRXaminer Forensics opens the reconstructed multi-disk array and the member images, identifies the Hikvision, Dahua, Uniview or other layout on top of it, lists recordings by channel and time including deleted segments and exports MP4 with a hash report for each file.
What about RAID 0 and RAID 1 recorders?
RAID 0 spreads video across drives with no parity, so a single failed member leaves gaps in every recording and a dead member means the footage on it is gone unless the drive itself can be imaged. The surviving members are still imaged and reconstructed, because the stripes they hold are intact and a stripe size of a few hundred kilobytes against video blocks of a gigabyte means long runs of playable footage survive. RAID 1 is a mirror, and either drive alone is a complete copy that reads like a single-drive recorder. The only RAID 1 trap is a mirror that split some time before the failure, where the two drives hold different footage and both should be read.
Which mistakes lose a RAID NVR for good?
| Action | Why it loses the footage | Do instead |
|---|---|---|
| Rebuild the degraded array in the NVR | Days of full reads; one URE or a second failure ends it | Image every member first |
| Delete and re-create the array | Uniview and others state this erases all data on it | Reconstruct from images |
| Initialise drives in another NVR or in Windows | Writes new structures over the recorder's | Keep every drive read only |
| Pull drives during a rebuild | Leaves the array in an inconsistent state | Power down cleanly, then image |
| Discard the failed member | Removes data the parity cannot replace | Image it with error skipping |
| Mix up the drive order | Reconstruction produces noise | Label bays before removal |
How does RAID recovery hold up as evidence?
Better than most, when it is done this way, because every step leaves a record. Each member image carries a hash taken at acquisition. The reconstruction parameters are written down. Every exported clip carries its own hash, and the original drives are never written to. That is the chain an investigator expects for any digital evidence, and the police complaint guide covers the handling note that goes with it. Ontrack's advice applies to every case: take a bit-for-bit image of each disk before making any change and label the disks with their position in the array.
Which recorders are we talking about?
| Vendor | RAID models | Levels |
|---|---|---|
| Hikvision | DS-9632NI-I8, DS-9664NI-I8, DS-96128NI, DS-96256NI | 0, 1, 5, 6, 10; hot spare |
| Dahua | NVR616DR series, IVSS7016 and other IVSS | 0, 1, 5, 6, 10; 50 and 60 on IVSS |
| Uniview | NVR308, NVR516, NVR824 | 0, 1, 5, 6, 10; 50 and 60 on NVR516 and NVR824 |
| Hanwha | PRN-6400DB4, PRN-6410B4, XRN-6410B4, XRN-3210B4, XRN-1620B2 | Per model; legacy XRN-2011 RAID 5, XRN-811S RAID 1 |
| TVT and OEMs | TD-3364H16 | 0, 1, 5, 6, 10 |
| Honeywell | MAXPRO NVR SE (Windows) | 0, 1, 5, 6, 10, 50, 60 |
In short
- A degraded RAID 5 still holds all the footage. The rebuild, not the failure, is where most arrays are lost.
- Power down, label every bay, keep the failed member and image each drive once through a write blocker.
- Reconstruct the array from the images using drive order, stripe size and parity rotation, then read the recorder layout on top.
- Never delete, re-create or re-initialise the array. Never let another recorder touch the drives.
Common questions
Is footage on a degraded RAID 5 NVR recoverable?
Yes. A degraded RAID 5 has lost one drive and is reconstructing reads from parity, with every recording still present. Power the NVR down, label the bays, image every member drive including the failed one through a write blocker and reconstruct the array from the images rather than rebuilding it in the recorder.
Should I let the NVR rebuild the RAID after replacing the failed drive?
Not before the footage is secured. A rebuild reads every sector of every surviving drive, which takes days on large surveillance drives. One unrecoverable read error or a second drive failure during that time loses the array. Gillware calls a failed rebuild the most common cause of RAID 5 loss it sees. Image the members first, then rebuild if you wish.
What does InActive or Fail mean on a RAID NVR?
The array has lost more drives than its level can tolerate and the NVR can no longer use it. Dahua calls this InActive and Hanwha calls it Fail. The member drives still hold their stripes. Recovery means imaging each drive, including failed ones that are partly readable, then reconstructing the array from the images.
Do I need the failed drive for RAID recovery?
Yes, keep it. Recovery labs state they need every member including any that already failed, because a partly readable failed drive supplies data that parity cannot reconstruct when a second drive has problems. Image it with a tool that skips and logs bad sectors.
Can a RAID 0 NVR be recovered after a drive fails?
Partly. RAID 0 has no parity, so stripes on the dead drive are gone unless that drive can be imaged. The surviving members still hold intact stripes, and because stripes are small against gigabyte video blocks, long runs of footage remain playable after reconstruction. RAID 1 mirrors read as single drives.
Which software reads a reconstructed NVR RAID array?
DVRXaminer Forensics opens multi-disk NVR arrays and E01, DD or AFF member images, identifies the recorder layout on the reconstructed array, lists recordings by channel and time with deleted segments and exports MP4 with a hash report per file. The Personal and Technician tiers read single drives.
Reconstruct the array, then read the recorder
DVRXaminer Forensics opens multi-disk NVR arrays and member images in E01, DD or AFF, identifies the Hikvision, Dahua, Uniview or other layout on top, lists recordings by channel and time including deleted segments and exports MP4 with MD5 and SHA-256 hashes in a case report. Talk to our team about a RAID case before touching the drives.
Sources
- Hikvision technical bulletin on configuring RAID (DS-96xx series, degraded state, hot spare); DS-9664NI-I8 datasheet
- Dahua NVR616DR and IVSS7016 specifications; reseller explainer of Dahua RAID statuses
- Uniview technical note How to Configure RAID (statuses, rebuild, array deletion warning); Uniview NVR308, NVR516 and NVR824 datasheets
- Hanwha Vision knowledge base, Info on RAID levels (models, Degraded and Fail definitions)
- Gillware RAID 5 data recovery and NVR RAID pages; Ontrack RAID recovery guidance; Hawk Eye Forensic RAID reconstruction article; Rossmann Group on why rebuilding a degraded RAID destroys data (URE arithmetic)
- Schroeder and Gibson, Disk failures in the real world, FAST 2007; IP Security Depot on surveillance RAID rebuild durations
- TVT TD-3364H16 listing; Honeywell MAXPRO NVR SE datasheet; DVRXaminer Forensics tier description on the buy page