Sherlock Forensics Recover: RAID Recovery That Proves the Array Before You Trust It

Sherlock Forensics Recover does not ask you to guess. Where the disks still record the array's own settings, it reads them. Where they do not, it searches the combinations of stripe size, disk order and parity layout. It scores each candidate against the file system that is actually on the array: the structures a valid layout must place at computed offsets across every disk. A wrong layout lands on some of those structures by chance and fails the rest. A right layout places all of them. It tells you which offset it found the data at, because a Linux array usually reserves the first megabyte of each drive, so a tool that only reads the start of the disk reports nothing recoverable on an array that is in fact perfectly rebuildable.

It rebuilds RAID 0, 1, 5, 6, 10 and JBOD from the member disks. A RAID 5 missing one disk is rebuilt from parity as it is read. A RAID 6 missing two is reconstructed through the second parity syndrome that RAID 6 carries for exactly that case. Nested RAID 50 and 60 are supported. The refusal is per group: a RAID 50 survives one lost disk in each group and a RAID 60 survives two. Three missing from a single group is refused rather than guessed at, because the parity to rebuild it does not exist.

When a disk dropped out of the array earlier and holds stale data, using it produces an array that mounts and is quietly wrong. Sherlock Forensics Recover refuses it and tells you why, rather than handing you a rebuild that looks fine and is not. Nothing is ever written to the member disks. Every recovered file carries a SHA-256 fingerprint and a record of where it came from.

Where a Linux array records its own level and stripe size, the tool reads them, but it confirms the member order by the search rather than trusting it outright, because member order is the setting a wrong guess gets wrong most often. It checks the offsets real controllers use, not arbitrary ones. For a nested array it asks you for the group count and the member order rather than detecting them, because twelve disks are a valid two-by-six, three-by-four or four-by-three and nothing in the bytes says which.

See the full tool on the Sherlock Forensics Recover product page. Compare it to UFS Explorer.