⚠ Do now
Server
data recovery
Brisbane.
The server is down, a drive has dropped out, or the screen is asking a question you do not want to answer wrongly.
Server data recovery starts with the drives: a server spreads your data across several of them, and the layout is recorded on the drives themselves. We take the drives, not the server, and copy each one on PC-3000 imaging equipment before any other work. The storage is then rebuilt in software from those copies, so your originals are only ever read.
How server recovery is priced- Free assessment
- Fixed quote before work starts
- Drives read, never written
- Emergency work 24/7
- 01Drive bays and sleds
- 02Drive lights
- 03Backplane and cables
- 04Controller card
- 05Controller cache and its battery or capacitor
Start from what you see
Part 1 of 4
Many drives, one volume.
The controller card presents every drive in the bays to Windows or Linux as one volume. The layout that says which piece of data sits on which drive is written to the drives themselves.
Part 2 of 4
A drive drops out.
The volume keeps running on the remaining drives, but it has no protection left against another failure. One more drive out, or a read error during a rebuild, can take the whole volume offline.
Part 3 of 4
The controller asks a question.
At boot the controller may offer to import, clear or re-enable the drives. Some of those answers rewrite the configuration, and some accept data loss, so the screen is photographed and left unanswered.
Part 4 of 4
In the lab.
Every drive is copied first, failed ones included. The volume is then rebuilt in software from those copies, and the shares, folders and databases you named are extracted from the rebuilt copy.
Executive engineer
Viktor Burcevski
Executive Data Engineer / Executive Forensic Consultant
Viktor leads the lab’s complex storage cases, including board-level repair and forensic extraction. On server jobs he scopes the storage from the first call and reviews every rebuild before any data is extracted.
Complex storage casesBoard-level repairForensic extraction
What Viktor works on
Controller arrays rebuilt from drive images, Windows and Linux volumes read from the rebuilt copy, and ransomware cases where the drives are kept as evidence.
Drives onlyThe server stays with you
Imaged firstBefore any rebuild or repair
Nothing to payIf you decide not to go ahead
15,000+Jobs since 2016
92%Recovery rate
Can it be recovered?
In many cases, yes. When a controller marks a volume offline, the data can no longer be reached through it; that is not the same as the data being erased. What the drives still hold depends on what happens next, because rebuilds, imports and repairs all write to them, so the free assessment checks each drive before anything is tried.
What do I do right now?
Leave every drive in its bay, photograph the screen and the drive lights, and answer no prompt. Do not press F1 or F2, import or clear a foreign configuration, or start a rebuild until the drives are assessed. If a rebuild is already under way, call 1300 806 557 before stopping it.
What does it cost and how long?
There is no set price, because the cost follows the number of drives, how they failed and what has been tried. Every drive is assessed free first, then you get a fixed quote with a realistic time estimate before any paid work, and you owe nothing if you stop there. Drives can be posted in from anywhere in Australia.
01 Symptoms · start here
Start with what the server is showing you
Pick the card that matches the screen, the drive lights or the alert email. Each card opens first aid for that fault, and your choice is carried into the enquiry form below.
Still running, but a drive has failed or a rebuild has started.
Careful · no rebuild yetThe volume has lost its protection: one more failure, or a read error during a rebuild, can take it offline.
While the shares still open, save the folders the business cannot work without to separate storage. Any new alert, slowdown or noise means stop and shut down cleanly.
Stopped at boot with a question on screen, or a volume marked offline.
Answer nothing · lab workA foreign configuration prompt, an HPE F1 or F2 choice or an offline virtual disk is the controller asking to change its records. Dell says clearing a foreign configuration erases the data on those disks, and HPE says F2 at message 1788 loses all data.
Photograph the screen and leave the prompt unanswered until the drives are assessed.
Neither of those? Pick the card closest to what you see.
I don’t know how the server is set up
That is fine. The enquiry works without it, and the engineer can work it out from the drives.
Ask them for the controller name and what has been tried, or send them our list of what to save before shutting the server down.
The maker’s name is usually on the front panel. Pick it below, or choose Not sure.
The maker’s name is usually on the front panel. Pick it below, or choose Not sure.
Noted as not sure in your enquiry. The engineer will work it out from the drives.
If the server runs virtual machines, the guests have their own page: virtual machine data recovery.
Know the make? Pick the name on the front panel.
Your server’s make
Dell PowerEdge
A foreign configuration can leave a volume degraded or failed. Dell says to import only when every member disk is present, and to import before discarding preserved cache.
Which one is yours?
Tap the model or card name on the label. It is added to your enquiry.
Your server’s make
HPE ProLiant
Message numbers on this page come from HPE’s ProLiant Gen9 documentation. Wording for Gen10 and later is not confirmed here.
Which one is yours?
Tap the generation or controller on the label. It is added to your enquiry.
Your server’s make
Lenovo ThinkSystem
These adapters are built on Broadcom MegaRAID controllers and are managed with Broadcom’s tools.
Which one is yours?
Tap the adapter on the label. It is added to your enquiry.
Your server’s make
Supermicro
This card uses a Broadcom 3108 controller.
Which one is yours?
Tap the card if it is fitted. It is added to your enquiry.
Your server’s make
Built by an IT provider
Tell us the controller card’s name from its label or the boot screen.
Your server’s make
Another make or not sure
That is fine. Photograph the front panel and any label, and the engineer will identify it.
Your selected recovery path
How the storage is set up is not chosen yet. That is fine: the engineer can work it out from the drives. Your setup: a hardware controller card. The card keeps the layout and writes it to the drives, so keep the card and every drive together. Your setup: Windows Storage Spaces. Note the health and operational state Windows shows for the pool, its virtual disks and each drive. Your setup: Linux md, LVM or ZFS. Read-only status output helps; anything that assembles, imports or repairs writes to the drives. Your setup: external storage attached to the server. Power the storage on before or with the server, and switch the server off first. Your setup: not sure. That is fine: the engineer can work it out from the drives.
Says “foreign configuration found”
Do now
- Photograph the message.
- If the controller or Lifecycle Controller log can be read without changing anything, note which disk went foreign last: it holds the newest data.
- Shut down cleanly unless a rebuild is running.
Avoid
- Clearing it. Dell says clearing a foreign configuration erases the data on those disks.
- Importing unless every member disk is present.
- Discarding preserved cache before any import.
Dell’s own import steps are for getting a server running again with a tested backup behind it.
The exact wording of these prompts is in the PERC and MegaRAID groups of our RAID controller message decoder.
Server volume offline or gone
Do now
- Leave every drive in its bay and note which lights are amber.
- Shut down cleanly unless a rebuild is running.
Avoid
- Fitting replacement drives. HPE says this does not improve a failed logical drive.
- Forcing a drive online, or accepting an initialise or create prompt.
Offline means the controller cannot assemble the data; the drives are assessed one by one.
Two drives dropped out together? Read about two drives lost at once on our RAID data recovery page.
One drive failed, server still running
Do now
- Save the folders you cannot lose, most important first.
- Photograph the alert.
- Check the health of every other drive before replacing anything.
Avoid
- Starting or allowing a rebuild without a tested backup.
- Assuming a hot spare makes it safe.
- Running a consistency check: it fixes errors automatically, so it writes.
Each drive is imaged on hardware imagers before any rebuild.
How hot spares and rebuilds behave on a server controller is set out in stage 08.
Rebuild stopped or finished with errors
Do now
- If it is still running, call 1300 806 557 before stopping it.
- Keep the drive that reported the media error in place.
- Note how far it got.
Avoid
- Pulling the drive with the media error. HPE says the logical drive then fails.
- Dell’s puncture fix (delete, recreate and initialise), which loses all data on the array, unless everything is backed up.
A punctured stripe is how a PERC finishes a rebuild despite a double fault; on HPE the rebuild stops instead.
Why rebuilds fail is explained on our RAID data recovery page.
HPE server asking for F1 or F2
Do now
- Photograph the screen.
- If 1785 shows up after anyone moved drives around, switch the server off and return each drive to the slot it came from.
Avoid
- F2 at 1779, which accepts data loss.
- F2 at 1788, which resets the configuration; HPE says all data will be lost.
- F1 at 1786, which starts a rebuild, unless every file is backed up.
Source of these message numbers and keys: HPE ProLiant Gen9 documentation.
Each HPE message is listed in the HPE group of our RAID controller message decoder.
Server down after a power cut
Do now
- Note any battery or cache message.
- With external storage, power it up before or with the server, and power the server down first.
Avoid
- Discarding preserved cache.
- Restarting again and again. Windows runs chkdsk at restart on a dirty volume, and Linux will not start a dirty, degraded md array without being forced.
HPE 1793 means cache data was lost because backup power was unavailable.
The question “Our server crashed after a power outage. Is the data gone?” is answered below.
Controller replaced or drives moved
Do now
- Keep the old controller and every drive together.
- Write down which bay each drive came from.
- On HPE, if 1785 appears after a move, power down and return the drives.
Avoid
- Fitting a new card and importing its configuration, which can write fresh metadata over the old.
- Moving drives one at a time. HPE says all drives move together, with no failed drives.
The layout is read from the drives themselves, so the chassis and card stay with you.
How controller failures reach the bench is covered on our RAID data recovery page.
Storage Spaces pool degraded or read-only
Do now
- Reconnect any missing drives first.
- Note the health and operational state Windows shows.
Avoid
Reset-PhysicalDisk, which wipes the drive.- Keeping a failing ReFS volume in use: ReFS can drop files it cannot repair from view.
Storage Spaces pools and the ReFS or NTFS volumes on them are rebuilt in the lab from the drive images.
Storage Spaces states are listed in the Storage Spaces group of our RAID controller message decoder.
Windows Server will not start
Do now
- Stop restarting it.
- Photograph the stop code or message.
Avoid
- chkdsk with
/f,/r,/xor/b, which writes. - Accepting a reinstall, reset or initialise prompt.
Volumes are read from the rebuilt copy, not from your drives.
Whether chkdsk is safe is answered in “Is it safe to run chkdsk on a server volume?” below.
Linux server storage will not mount
Do now
- Save the output of read-only commands (
mdadm --detail,mdadm --examine,smartctl,zpool status) and paste it into the free RAID evidence reader, which runs in the browser and uploads nothing. - Copy
/etc/lvm/backupoff the server if it can be read.
Avoid
mdadm --assemble --forceor--create.zpool import -F,-Xor-T.- fsck or e2fsck without
-n. vgcfgrestore --force.
Linux md arrays built with mdadm, ZFS pools and LVM volume groups are rebuilt in the lab from the drive images.
Paste that output into the free RAID evidence reader before anything else is run.
SQL or Exchange database will not start
Do now
- Copy every database file (
.mdf,.ndf,.ldf), or the Exchange database and its log files, to separate storage first. - If the storage underneath is failing, start with the cards above.
Avoid
- DBCC CHECKDB with REPAIR_ALLOW_DATA_LOSS. Microsoft says it can lose more data than a restore.
- Eseutil /P before copies exist.
SQL Server and Exchange databases are recovered from the rebuilt copy, not from your drives. Microsoft’s support policy is that a repaired Exchange 2007, 2010 or 2013 database has its mailboxes moved to a new database.
The first steps are also answered in the database question below.
Ransom note or locked files
Do now
- Disconnect it from the network first: unplug the cable or disconnect it at the switch.
- Power down only if you cannot disconnect it, because powering off loses evidence held in memory.
- Call 1300 806 557.
Avoid
- Wiping, reinstalling or restoring over it before every drive is imaged.
- Leaving backup drives connected: attackers go after shadow copies and backups they can reach.
Without a clean backup, have every drive imaged before any clean-up tool runs, so its current state is kept.
Read more on ransomware data recovery, including notifiable data breaches and ransomware.
Choose a card to see first aid for that fault.
A NAS box rather than a server? See NAS data recovery. Want RAID levels explained? See RAID data recovery.
Server symptoms, answered
The questions people ask when a server fails
Each answer comes first, in two or three sentences, with a link to the matching card above.
Our server won’t boot after a drive failed. What should we do?
Stop restarting it and photograph whatever is on the screen. Each restart can run a disk check on a Windows volume marked dirty, and a Linux array that is both dirty and degraded will not start unless forced, which risks corruption. Leave every drive in its bay and have them assessed before anyone tries a repair.
Our server crashed after a power outage. Is the data gone?
Not necessarily. A power cut can cost the data waiting in the controller’s cache: HPE message 1793 reports that loss, and a Dell PERC keeps unwritten cache as preserved cache until it is imported or discarded. Note every cache or battery message and do not discard preserved cache.
What does Interim Recovery Mode mean on an HPE server?
A drive in the array has failed or gone offline, and the controller is running on the rest. HPE says the logical drive might not be fault tolerant and may fail if another drive fails. Save what you cannot lose, then stop and have the drives assessed before replacing anything.
Should we press F1 or F2 at an HPE boot message?
Not unless every file is in a backup you have tested. At 1779, F2 accepts data loss; at 1788, F2 resets the configuration and HPE says all data will be lost; at 1786, F1 starts a rebuild (from HPE’s ProLiant Gen9 documentation). Photograph the message and leave it unanswered.
Smart Array says the logical drive failed. Is the data still there?
The controller has stopped assembling it, because more drives dropped out than the layout tolerates. HPE says fitting replacement drives does not improve a failed logical drive, and data re-enabled at 1779 should be treated as suspect. Leave the drives in their bays and have each one imaged first.
What is a punctured stripe on a Dell PERC?
It is how a PERC finishes a rebuild despite a double fault: the array gets its redundancy back, but the data in that stripe is lost and later shows up as media errors. Dell’s fix deletes and recreates the array, losing all data on it, so Dell says to take a file-level backup first.
Is it safe to run chkdsk on a server volume?
Not on a failing volume without a tested backup. With /f, /r, /x or /b, chkdsk repairs the volume, which writes to it, and Windows runs it by itself at the next restart if the volume is marked dirty. On Linux, e2fsck is read-only only with -n.
Our ReFS volume looks corrupt. What now?
Stop using the volume. ReFS repairs damage only when a good copy exists on a mirror or parity space; without one, it can remove files it cannot repair from view and keep the volume online. We recover ReFS volumes from images of the drives, so nothing more is written to them.
Our LVM volume group is missing. What should we do?
Do not re-create anything or run vgcfgrestore with --force. If /etc/lvm/backup can still be read, copy it off the server, because LVM keeps each volume group’s layout there. We rebuild LVM volume groups in the lab from images of the drives.
Our SQL Server database is suspect, or Exchange will not mount. What first?
Copy every database file before any repair: the .mdf, .ndf and .ldf files for SQL Server, the database and its log files for Exchange. Microsoft says REPAIR_ALLOW_DATA_LOSS can lose more data than restoring a backup. We recover SQL Server and Exchange databases from copies, never from the live files.
Before anyone touches it
What is safe on a failed server, and what is not
Safe on a failed server
- Photograph the front panel, the drive lights, the screen and any alert emails.
- Write down each message and the order the drives dropped out.
- Mark each drive with the number of its bay before it comes out of the chassis.
- Keep failed and replaced drives together, including any that reported a media error.
- With external storage attached, power it on before or with the server, and switch the server off first.
Not safe on a failed server
- F2 at an HPE 1779 or 1788 prompt.
- Clearing a foreign configuration or discarding preserved cache.
- chkdsk with
/for/r, fsck without-n, or a consistency check. - Forcing an md array together, or importing a ZFS pool with
-F. - Resetting a Storage Spaces drive.
- Repairing a SQL or Exchange database before copying its files.
Call us before you go further
- A screen or alert that says “foreign configuration” or “preserved cache”.
- A rebuild that is running or stopped part way.
- A ransom note or signs of unauthorised access.
- A server that may be evidence, or holds personal information a breach could expose.
From the Wildfire lab
Our latest research for server owners, straight from the bench.
What we are seeing on business systems right now, written up so you can plan before something fails.
14 Apr 2026What data loss really costs Australian businesses
What it isThe costs Australian businesses face when data is lost, and the most common causes.
Why it mattersIt puts a number on downtime, so backups and recovery plans can be costed.
Read the research →
Ransomware data recovery: the first hour and the deadlines
What it isWhich first steps apply to a computer, a NAS or a server, and where files come back from without paying.
Why it mattersAustralia sets a 72-hour payment report and a 30-day breach assessment, and the page has a drill to practise the first ten minutes.
Read the research →
The 2026 storage crisis: why hard drives sold out
What it isWhy hard drives sold out in 2026 and prices rose.
Why it mattersA replacement drive may take longer and cost more, so the data on the old one matters more.
Read the research →Free tools from
this research
RAID Evidence ReaderPaste read-only output. Runs in your browser, uploads nothing.
Array PassportRecord bay order and serials before anything fails.
02 Costs
How much does server data recovery cost?
Server data recovery has no set price, because the cost depends on how many drives the server holds, how each one failed and what has been done to them since. Every drive gets a free assessment first, and you then receive a fixed quote before any paid work begins. If you decide not to go ahead, you owe nothing.
What the free assessment measures
What sets the price of a server job
How many drives are in the chassis
Each one is imaged, including the drives the controller still reports as healthy.
Which drives failed, and how
Electronic, mechanical or media errors each need different work before a drive can be imaged.
Rebuilds, imports or repairs already run
Each one can change what is on the drives, and the engineer has to work out what changed.
Controller card, Storage Spaces or Linux layout
How the data was spread across the drives decides the reconstruction work.
The controller’s cache and firmware state
Preserved or lost cache affects how current the newest writes are on the drives.
Encrypted volumes
The keys or recovery details are needed before the volume can be read.
Databases and mail stores to open and check
SQL Server databases and Exchange stores are opened and checked, not only copied.
How soon the business needs it back
Standard, Critical Priority and Emergency 24/7 set when an engineer starts, not how the work is done, and any priority fee is agreed with you before booking.
Before you spend anything
Is server data recovery worth it?
It is worth it when the server held data that no tested backup covers and that matters more to the business than the quote. The assessment is free and shows which files are recoverable before you pay anything, so the decision is made with the file list in front of you.
Worth it when
Accounts, client records, databases or shared folders the business runs on are in no backup you have tested.
Maybe not when
A tested backup holds everything that matters, or the data can be recreated for less than the quote.
How to decide
Look at the file list and the fixed quote. If it is not worth it, you stop there, owe nothing, and the post-in label was free.
03 Process
How we recover data from a failed server
We copy every drive first and work only on the copies. The engineer works out how the controller spread the data across the drives, rebuilds the volume in software, and extracts the shares, folders and databases you named. Nothing is rebuilt on, or written to, your original drives.
1
Record the server
Make, model, controller, bay order, every message and everything already tried are written down before a drive is handled.
2
Copy every drive
Each drive is imaged on PC-3000 equipment. A drive that will not read gets firmware, head or board work until it can be imaged.
3
Work out the layout
Drive order, block size, parity placement and start offsets are found in the data and checked against the file system.
4
Rebuild in software
The volume is assembled from the images. Your drives stay untouched.
5
Recover the volumes
Windows and Linux volumes on the rebuilt copy are read and the data extracted.
6
Check and show you
Priority shares and databases are opened and checked, and you see the file list before you pay.
04 Laboratory
Your server job in our Brisbane lab
One Brisbane lab handles the job from intake to return, and the drives are not forwarded to anyone else. Our own engineers image server drives on PC-3000 equipment, open drives only on ISO Class 5 rated clean-air benches, and keep every copy of your data in Australia.
Engineers who work on server jobs
Martin Daniels
Electrical Engineer
Handles the hardware under a server's storage: drives that will not spin up or read, controller and power faults, and donor parts.
David Williams
Co-founder · mobile & encryption
Handles BitLocker and other encrypted server volumes, opened with the client's own recovery keys.
Reviews from Wildfire clients on Google
4.8 from 96 reviewsRead them all →
“Great communication with fast service, managed to retrieve all family photos and videos off a broken hard drive.”
“Excellent Data Recovery and re set up. Viktor goes above and beyond to explain everything regardless of how long it takes. After disasters through the years gone by with other so-called experts, it was stessfree and a relief to discover Wildfire. Excellent pricing and communication. ☆☆☆☆☆ Highly recommend 👌”
“Wildfire Data Recovery were fantastic to deal with from start to finish. Extremely responsive to any customer requests and we able to perform data recovery and phone repair where Samsung official repairer advised they would not likely be able to preserve the data. Very satisfied with Viktor and his team. Highly recommend 👌”
Before you send the drives anywhere
Questions to ask any lab before you send a server’s drives
Are all drives copied before any rebuild?
The answer should start with imaging every drive.
Is anything written to the originals?
Repairs, imports and rebuilds change the drives, so a careful lab works on copies only.
Will I see the files and the price before paying?
A file list and a fixed quote let you decide with the facts in front of you.
Where is the work done, and what happens to the copies?
Ask where the drives go, who handles them and when the images are deleted. We sign NDAs and invoice companies. Our copies of your drives are kept in the Brisbane lab for 14 days after your data is delivered, then securely wiped.
Wildfire’s answers are on this page: the process in stage 03, the quote in stage 02 and the lab details in stage 06.
05 Start
Tell us what the server is doing
Send the form or call 1300 806 557. If you picked a fault card above, it is already filled in for you to check.
Free assessment, fixed quote.
Sending this form does not approve any paid work.
Prefer to talk?
1300 806 557Ready to send the drives now? Submit a job →
06 Delivery
Posting the drives in from anywhere in Australia
Our lab is in Brisbane, and anyone in Australia can post the drives in. Call or send the form first, and we email a free tracked post-in label, or book a courier to collect the drives within the hour for $85 (up to $120 further out from the city). There is no shop front: every job starts with a call or the form.
Lab and business details
- Lab address
- 51 Aquila Circuit, Banksia Beach QLD 4507. Drop-off by appointment.
- Opening hours
- Mon to Fri, 9am to 5:30pm, and Sat, 10am to 4:30pm AEST, with emergency triage and critical server intake 24/7 on 1300 806 557
- admin@wildfiredata.com.au
- How your drives and data come back
- Recovered data on new media or by secure download, with tracked shipping. Original drives come back free by tracked post, by courier within the hour for $85 (up to $120 further out from the city), or you collect them from the lab by appointment.
- Payment
- Businesses are invoiced. Everyone else pays once the file list is approved, before the data is released.
- Contact
- Contact page · 1300 806 557
Photograph before you unplug
The front panel, bay numbers, drive lights and any message on screen.
Shut down cleanly
Use the operating system’s shutdown. If a rebuild is running, call first.
Number every drive by its bay
Write the bay number on each drive before it leaves the chassis.
Send every drive, failed ones too
Include drives that were replaced or pulled, and the one that reported a media error.
One anti-static bag per drive
Then a firm box with padding, never drives loose together.
The server stays with you
The layout is read from the drives, so the chassis, controller and power supplies stay on site. Leave the old controller in place; fitting a new one and importing can write fresh metadata over the old.
Is the controller still rebuilding?
Ring 1300 806 557 first: stopping a rebuild halfway can do more harm than letting it finish.
Need the data as evidence?
Say so before the drives are sent: a forensic job needs an agreed scope and is quoted first. See digital forensics.
Looking after several servers?
Record each array’s layout before it fails with the free Array Passport.
Tick the checks as you prepare the parcel.
Track My Recovery
Follow the job online
Each job gets its own private tracking link that shows which stage it has reached. The tracker below is the real one, shown with a sample job.
How long does server data recovery take?
It depends on how many drives there are and how well each one images, so the time is set after the free assessment. You get a realistic estimate with the fixed quote, before any paid work. Critical Priority and Emergency 24/7 start sooner and run around the clock.
How much does it cost?
It is quoted per job after a free assessment of every drive, and you owe nothing if you decide not to go ahead. The cost factors are set out in stage 02.
Is it worth paying for?
When no tested backup holds the data and the data matters more than the quote, usually yes. The assessment shows which files are recoverable before you spend anything.
Should I try recovery software first?
Not on the original drives. On a server, software first needs the drives to appear as one volume again, and getting there usually means a rebuild, an import or a forced assembly, all of which write to the drives. If the files are worth a quote, have every drive imaged before anything is run.
Can you work with our IT provider or managed service provider?
Yes. With written authority from the business that owns the data, we deal directly with the IT provider you nominate. They can brief us on the setup, ship the drives and restore services once the data is back.
Is our data kept confidential, and does it stay in Australia?
Your drives and data stay in Australia, in one Brisbane lab, and are not forwarded to another company. We sign NDAs and invoice companies. Our copies of your drives are kept for 14 days after your data is delivered, then securely wiped.
Can you provide a report for insurance or a legal matter?
Tell us before the drives are sent. A forensic job needs an agreed scope for preservation, acquisition and reporting, quoted before intake; see digital forensics.
Do we get a working server back, or just the files?
You get verified copies of the files and databases you named, on new media or by secure download. Getting services running on new hardware is your IT provider’s job, and we can work alongside them.
What is preserved cache, and can we discard it?
It is data the controller had not yet written to the drives when a volume went offline, and a Dell PERC keeps it until the volume is imported or the cache is discarded. Dell strongly advises importing any foreign configuration first, or data may be lost. Do not discard it; call first.
What happens if the data cannot be recovered?
You are told plainly and owe nothing for the recovery. Your drives come back free, by tracked post or collected from the lab by appointment. Read our No Data, No Fee policy.
Questions about importing or clearing a foreign configuration, a failed controller, hot spares and rebuild safety, or reporting a data breach are answered on our RAID data recovery page.
08 Learn
How server storage works, and how it fails
The parts inside a rack server that decide what can be recovered, how hot spares and rebuilds behave, the Windows Server support dates, and what an IT provider should save first.
Inside a rack server
Inside a rack server: the parts that decide recovery
Tap a number on the drawing to see what that part does and what it means for your data.
Tap a number
Drive bays and sledsPart 1
What it is
Each drive sits in a sled in a numbered bay at the front of the server.
What it means for your data
The bay order is part of the layout. HPE says drives that were moved go back to their original bays, so label each drive with its bay before it leaves the chassis.
Drive lightsPart 2
What it is
Each bay has a light that shows activity, faults or a drive the controller has marked.
What it means for your data
Photograph them before anything is unplugged. Which lights were amber, and in which bays, helps show the order the drives dropped out.
Backplane and cablesPart 3
What it is
The board behind the bays, and the cables that connect it to the controller card.
What it means for your data
A loose or failed cable can drop a drive just like a failed drive can, so a drive marked failed is not always a failed drive.
Controller cardPart 4
What it is
The card that presents the drives as one volume to Windows or Linux.
What it means for your data
It keeps the layout and writes it to the drives. A replacement card sees that layout as a foreign configuration, so keep the old card and every drive together.
Cache and its battery or capacitorPart 5
What it is
Memory on the controller that holds data waiting to be written, protected by a battery or capacitor.
What it means for your data
Unwritten data waits here. If backup power fails, HPE reports it as lost cache, and a Dell PERC keeps it as preserved cache that should not be discarded.
Before anyone trusts a rebuild
Hot spares and rebuilds on a server controller
A hot spare changes when a rebuild starts, not what the rebuild has to survive.
One group, or every group
A hot spare can be dedicated to one drive group or shared by every group on the controller.
Sooner, not safer
A spare starts the rebuild sooner, but the rebuild still relies on every surviving drive being read in full.
Hours without protection
HPE’s own Smart Array figure is 200 GB per 15 minutes, slowed by server load, rebuild priority, the number of drives and other factors, so the server can be unprotected for a long time.
A read error ends it differently
An HPE rebuild stops at a read error, while a PERC can finish by puncturing the stripe and losing the data in it.
Whether a hot spare makes a rebuild safe is also answered on our RAID data recovery page.
Dated note · as at 6 November 2026
Windows Server 2012 R2 and 2016: the support dates
Microsoft lists extended support for Windows Server 2012 R2 as ended on 11 October 2023, and its last year of paid security updates as ended on 14 October 2026. Extended support for Windows Server 2016 ends on 13 January 2027. All dates are US Pacific time.
A server that no longer receives security updates should not face the internet while it waits to be replaced.
- Windows Server 2012 R2: extended support ended 11 October 2023; paid security updates ended 14 October 2026.
- Windows Server 2016: extended support ends 13 January 2027.
For IT providers
What your IT provider should save before shutting the server down
Read-only items only. Nothing on this list changes the drives.
- Photos of the screen and the drive lights.
- Every message, and the order the drives dropped out.
- Controller or Lifecycle Controller log timestamps, read without changing anything.
mdadm --detailandmdadm --examineoutput for Linux md arrays.smartctloutput for drives behind a PERC (-d megaraid,N) or Smart Array (-d cciss,N), on Linux and FreeBSD only.- A copy of
/etc/lvm/backup. - A list of everything already tried.
Paste command output into the free RAID evidence reader, and record each array’s layout before the next failure with the free Array Passport.
09 Library
Server reference: makes, controllers and status words
Each record says what the term means, what it means for recovery, what not to do, and where the fact comes from.
Looking for the exact wording of a controller message, such as a PERC boot prompt or an HPE 17xx code? Our RAID controller message decoder lists them with the vendor source for each.
34 records
Makes and modelsDell PowerEdge (R640, R740, R760, T640)Dell · rack and tower servers
Dell’s rack and tower servers, usually fitted with a PERC controller card. These four models are the ones Dell names in its foreign configuration guidance.
Dell says to import a foreign configuration only when every member disk is present, and to import before discarding preserved cache. Clearing a foreign configuration erases the data on those disks.
Makes and modelsHPE ProLiant Gen9HPE · message numbers on this page
The startup message numbers on this page (1779, 1785, 1786, 1788 and 1793) and the F1 and F2 choices come from HPE’s ProLiant Gen9 troubleshooting guide.
Do not press F1 or F2 at these messages unless every file is in a backup you have tested. Photograph the screen instead.
Makes and modelsHPE ProLiant Gen10 and laterHPE · wording not confirmed here
Message wording for Gen10 and later has not been confirmed for this page, so the Gen9 numbers above may not match your screen.
Photograph the screen exactly as shown and send the photo with the enquiry. Leave the prompt unanswered in the meantime.
Makes and modelsLenovo ThinkSystem with RAID 940 adaptersLenovo · Broadcom MegaRAID based
ThinkSystem servers can carry the RAID 940 series adapters, which are built on Broadcom MegaRAID controllers and managed with Broadcom’s tools.
Note the adapter name from its label or the boot screen. Lenovo’s own import steps are not covered on this page.
Makes and modelsSupermicro with the AOC-S3108L-H8iR cardSupermicro · this card only
This Supermicro add-on card uses a Broadcom 3108 controller. That applies to this card only, not to every Supermicro server.
Note which card is fitted before any drive is moved or the card is replaced.
Controller cardsDell PERC 9 (H330, H730, H830)Dell · preserved cache
When a virtual disk goes offline with data still in the controller’s cache, a PERC 9 keeps that data as preserved cache. Dell advises importing any foreign configuration before discarding it, or data may be lost.
A degraded virtual disk keeps working with less protection than it was built with. Do not discard preserved cache.
Controller cardsDell PERC 11 (H755, H750, H355, H350)Dell · foreign configuration at startup
At startup a PERC 11 can stop with a foreign configuration message when it finds drives carrying configuration data it does not hold. The choices offered change the controller’s records.
Do not clear the configuration, which erases the data on those disks, and do not import unless every member disk is present.
Controller cardsHPE Smart Array (ProLiant Gen9 documentation)HPE · logical drives
Smart Array runs a logical drive in Interim Recovery Mode after a drive fails, marks it failed when more drives drop out than the layout tolerates, and stops a rebuild at a read error. HPE says drives moved to another server go together, with no failed drives, and back to their original bays.
Do not pull the drive that reported a media error, and do not fit replacement drives to a failed logical drive.
Controller cardsBroadcom MegaRAIDBroadcom · also inside Lenovo and Supermicro cards
MegaRAID controllers keep the array layout and write it to the member drives. A hot spare can serve one drive group or every group on the controller.
Do not run a consistency check on a failing array: it fixes errors automatically, so it writes.
Controller cardsLenovo ThinkSystem RAID 940-8i, 940-16i, 940-32iLenovo · tri-mode on the 8i and 16i
Internal adapters built on Broadcom MegaRAID controllers and managed with Broadcom’s tools. The 8i and 16i are tri-mode adapters.
Note the adapter name and keep it with the drives if the server is replaced.
Controller cardsSupermicro AOC-S3108L-H8iRSupermicro · Broadcom 3108 controller
A Supermicro add-on card built on a Broadcom 3108 controller.
Keep the card with the drives if the server is replaced: the layout is written to the drives, and a new card sees it as a foreign configuration.
Controller status wordsOptimalEvery drive present
Every member drive is present and the volume has its full protection.
Optimal does not mean backed up. A tested backup is still the only protection against deletion or ransomware.
Controller status wordsDegradedRunning without protection
A member drive has failed or dropped out and the volume keeps running on the rest, without the protection it was built with. One more failure, or a read error during a rebuild, can take it offline.
Do not start a rebuild without a tested backup, and do not assume a hot spare makes it safe.
Controller status wordsPartially DegradedSome protection left
A volume built to survive two drive failures has lost one: some protection remains, but less than it was built with.
Treat it as urgent. Save what you cannot lose and have the drives assessed before replacing anything.
Controller status wordsOfflineThe controller cannot assemble it
The controller can no longer assemble the volume, usually because more drives are out than the layout tolerates. The data can no longer be reached through the controller; that is not the same as the data being erased.
Do not force drives online or accept an initialise or create prompt.
Controller status wordsInterim Recovery ModeHPE Smart Array
HPE’s term for a logical drive running on its remaining drives after one has failed or gone offline. HPE says the logical drive might not be fault tolerant and may fail if another drive fails.
Save what you cannot lose, then stop and have the drives assessed before replacing anything.
Controller status wordsForeign configurationDell PERC and MegaRAID
The controller has found drives carrying configuration data it does not hold, for example after a card was replaced or drives were moved. A replacement card sees the old layout this way.
Do not clear it (Dell: this erases the data on those disks), and do not import unless every member disk is present.
Controller status wordsPreserved cache (Dell PERC)Unwritten data kept by the card
Unwritten data the controller kept when a volume went offline. Dell advises importing any foreign configuration before discarding it, or data may be lost, and blocks new volumes while it exists.
Do not discard it.
Controller status wordsPunctured stripe (rebuild with errors)Dell PERC
How a PERC finishes a rebuild despite a double fault: the array gets its redundancy back, but the data in that stripe is lost and later shows up as media errors.
Do not use Dell’s fix (delete, recreate and initialise) unless everything is backed up: it loses all data on the array.
Controller status wordsUnconfigured Bad and Failed drive statesMegaRAID-based tools
Failed marks a drive that was in a volume, or was a hot spare, on which the controller found an error it could not recover from. Unconfigured Bad marks a drive outside any volume on which it found one.
Do not force a failed drive back online to bring the volume up.
Windows ServerStorage Spaces pool read-onlyStorage Spaces
Windows has set the pool read-only, for example because drives are missing or failed, so it can no longer be changed safely.
Reconnect missing drives first and note the health and operational state shown. Do not run Reset-PhysicalDisk, which wipes the drive.
Windows ServerVirtual disk IncompleteStorage Spaces
Too many of the drives the virtual disk uses are missing, failed or out of date for it to be read.
Reconnect missing drives before anything else, and do not reset any drive.
Windows ServerVirtual disk DegradedStorage Spaces
Some copies of the data are missing because a drive has failed or been disconnected, but the virtual disk still works.
Save what you cannot lose, then have the drives assessed before anything is replaced.
Windows ServerNo redundancyStorage Spaces
Microsoft describes this state as the virtual disk having lost data because too many drives failed.
Stop using the volume and have every drive imaged before any repair.
Windows ServerDrive Split, Stale metadata or Unrecognized metadataStorage Spaces
Operational states Windows shows for a drive whose pool records disagree with the rest of the pool or cannot be read.
Do not run Reset-PhysicalDisk to clear the state: it wipes the drive.
Windows ServerVolume dirty bit setNTFS and chkdsk
Windows marks a volume dirty when it may be damaged, and runs chkdsk on it by itself at the next restart.
Do not keep restarting, and do not run chkdsk with /f, /r, /x or /b, which writes.
Linuxmd array inactivemd and mdadm
The md driver has not started the array, for example because members are missing or the array is both dirty and degraded.
Save mdadm --detail and mdadm --examine output. Do not run mdadm --assemble --force or --create.
Linuxmd device faultymd and mdadm
The md driver has taken a member out of active use because of a detected fault.
Do not add it back or re-create the array. Image the drives first.
LinuxDirty and degraded md arraymd and mdadm
Linux will not start an array that is both dirty and degraded unless it is forced, because corruption could go undetected.
Do not force it: a forced assembly writes to the drives.
LinuxZFS DEGRADEDOpenZFS
A device or vdev has failed, but there is still enough redundancy for the pool to keep working.
Save zpool status output and have the drives assessed before replacing anything.
LinuxZFS FAULTEDOpenZFS
The device or vdev cannot be used; for a pool, it means the pool cannot be accessed.
Do not run zpool import -F, -X or -T, which can roll the pool back and discard its most recent writes.
LinuxZFS REMOVED or OFFLINEOpenZFS
REMOVED means the device was physically removed while the system was running. OFFLINE means an administrator took it offline.
Do not re-create the pool or import it with recovery options.
LinuxLVM volume group missingLVM
Linux cannot find the volume group, so its logical volumes cannot be mounted. LVM keeps a text backup of each volume group’s layout in /etc/lvm/backup.
Copy /etc/lvm/backup off the server if it can be read. Do not re-create anything or run vgcfgrestore --force.
No records match. Try another word, clear the search or choose All records.
Plain words
Server recovery terms in plain words
- Array
- Several drives that a controller or operating system presents as one volume.
- Controller card
- The card that manages the drives, keeps the array layout and writes it to the drives.
- Virtual disk or logical drive
- The volume the controller presents to Windows or Linux. Dell calls it a virtual disk and HPE a logical drive.
- Member drive
- One of the drives that together hold a volume.
- Bay and sled
- The slot at the front of the server, and the carrier the drive sits in. Bay order is part of the layout.
- Backplane
- The board behind the bays that connects the drives to the controller through its cables.
- Hot spare
- A spare drive the controller uses to start a rebuild by itself, for one drive group or for all of them.
- Rebuild
- The controller recreating a missing drive’s data on a new drive by reading every surviving drive.
- Consistency check
- A controller task that compares data across the drives and fixes errors automatically, so it writes.
- Double fault
- Two problems in the same stripe at once, such as a missing drive and a read error on another.
- Image
- A sector-by-sector copy of a drive. Recovery work runs on images, not on your drives.
- Storage Spaces pool
- Windows grouping drives into a pool and creating virtual disks from it.
- ReFS
- A Windows Server file system that repairs damaged data when a good copy exists on a mirror or parity space.
- md array
- A Linux software array run by the md driver and managed with the mdadm tool.
- LVM volume group
- A Linux pool of storage that logical volumes are carved from. Its layout is backed up in
/etc/lvm/backup. - ZFS vdev
- A group of drives inside a ZFS pool, such as a mirror, that the pool stores data across.
Sources
Sources for the facts on this page
The vendor and government documents behind the technical lines on this page.
All 28 sources
Dell
- Dell knowledge base 000139205, version 7 of 13 May 2026: Foreign configurations on PowerEdge PERC controllers, general rules.
- Dell knowledge base 000139251, version 13 of 1 May 2026: Double faults and punctures.
- Dell PERC 11 user guide for the H755, H750, H355 and H350: The foreign configuration found message.
- Dell PERC 9 user guide for the H330, H730 and H830: Preserved cache.
- Dell PERC 9 user guide for the H330, H730 and H830: Virtual disks in a degraded state.
- Dell iDRAC9 with Lifecycle Controller user guide: Clearing a foreign configuration.
HPE
- HPE document 795673-007, edition 7 of August 2023: ProLiant Gen9 troubleshooting, volume 2 (error messages).
- HPE document a00020470en_us: Drive procedures for Smart Array controllers.
Broadcom and Lenovo
- Broadcom technical documentation: Glossary of the 12Gb/s MegaRAID tri-mode software, version 1.0.
- Lenovo Press LP1282, 8 October 2026: ThinkSystem RAID 940 series adapters.
Supermicro
- Supermicro product page: AOC-S3108L-H8iR add-on card.
Linux
- Linux kernel documentation: The md driver.
- Linux manual pages: mdadm(8).
- LVM 2.03.42 manual pages: vgcfgbackup(8) and vgcfgrestore(8).
- OpenZFS manual pages: zpoolconcepts(7) and zpool-import(8).
Microsoft Windows Server
- Microsoft Learn, Windows Server storage: Storage Spaces health and operational states.
- Microsoft Learn, Windows Server storage: ReFS overview.
- Microsoft Learn, Windows commands: chkdsk.
- Linux manual pages, used beside chkdsk on this page: e2fsck(8).
- smartmontools 7.3 manual page: smartctl(8).
SQL Server and Exchange
- Microsoft Learn, SQL Server: DBCC CHECKDB.
- Microsoft Exchange Team blog: Eseutil repairs: when and how.
- Microsoft Exchange Team blog: Support policy for repaired Exchange databases.
Security and government
- CISA StopRansomware: First steps after a ransomware attack.
- MITRE ATT&CK: Technique T1490, inhibit system recovery.
- Microsoft product lifecycle: Windows Server 2016.
- Microsoft product lifecycle: Windows Server 2012 R2.
- OAIC: Notifiable data breaches scheme.
Before anyone presses a key
Get the drives assessed before anything else is tried
The assessment is free, the quote is fixed before any work, and if the data cannot be recovered you are told so and owe nothing.