Read the relevant page, build a recovery brief, call an engineer, or send the case securely, without opening a second popup.
Problem, device and brand cards are normal page links. The assessment button builds a saved recovery brief.
Choose the closest description. If you arrived from a problem card, this step is already complete.
Brand, model family, exact model and capacity improve the handoff to the correct engineer.
Tick everything that applies. “Other” fields are available where the usual choices do not fit.
This is an intake guide, not a remote diagnosis or guarantee. The laboratory confirms the method, quote and limitations after assessment.
Read the recovery method, limitations and intake process for this device or issue.
Read the relevant pageBest for uncertainty, dangerous batteries, active incidents, legal deadlines and Emergency 24/7.
Call 1300 806 557Keep the menu open and load Wildfire’s secure submission form in this same full-screen panel.
Save the structured summary for a call, email, internal approval or later submission.
Free tool: RAID evidence reader
Paste what your RAID or NAS array and its drives report. The reader picks out the lines that matter, grades each finding OK, Watch, Warning or Stop, and gives a cautious call on whether a rebuild is worth the risk.
Last checked
Tool
RAID calculators work from spec sheets. This reader works from your own array. Paste the text from cat /proc/mdstat, mdadm, smartctl or zpool status and it picks out the lines that matter, grades each array and drive as OK, Watch, Warning or Stop, and gives a cautious call on whether a rebuild is worth the risk.
It works out which member left the array first, spots unreadable sectors on the drives a rebuild would lean on, and reads ZFS pool states. The reading happens in your browser: nothing you paste is sent anywhere.
One output or several, one after another. Shell prompts and blank lines are fine: the reader works out which command each part came from and updates as you paste.
Your pasted text never leaves this page. Remove serial numbers first if you plan to share a screenshot.
Try an example (made-up output, clearly marked)
Run these over SSH as an admin. On Synology and QNAP, type sudo -i first. None of them changes anything on the disks.
cat /proc/mdstat mdadm --detail /dev/md0 mdadm --examine /dev/sda1 /dev/sdb1 /dev/sdc1 smartctl -x /dev/sda zpool status -v
Run mdadm --examine and smartctl for every member: use the partition and disk names that /proc/mdstat lists. Newer Synology units name disks /dev/sata1, /dev/sata2 and so on.
Drives behind a Dell PERC or Broadcom MegaRAID card: smartctl -x -d megaraid,0 /dev/sda, changing the number for each drive. HPE Smart Array: -d cciss,0.
Do not run anything that writes: no mdadm --create or --assemble --force, no fsck or chkdsk, no zpool import -f, zpool clear or zpool replace. If a command asks you to confirm, stop there.
Waiting for output
Your reading appears herePaste the output of one of the commands on the left, or try an example. The verdict comes first, then what each array and drive is saying.
Rebuild or stop? checker RAID controller message decoder
A guide based on the text you paste, not a diagnosis. It cannot see your drives, a hardware RAID controller or the kernel log, and it cannot tell you whether data is recoverable. When in doubt, stop and ask: a rebuild that fails part-way is much harder to recover than one that was never started.
Honest limits
SMART and RAID status are the drives and the array describing themselves. They catch a lot, and they miss a lot. These are the figures behind the reader's caution.
39×
In Google's study of more than 100,000 drives, a drive was 39 times more likely to fail within 60 days after its first scan error. That is why pending and uncorrectable sectors mean Stop here. Yet more than 36% of the drives that failed had shown no SMART warning at all.
23.3%
Backblaze watches the same five SMART values this reader checks first: 5, 187, 188, 197 and 198. In its fleet, 23.3% of the drives that failed showed none of the five beforehand.
2 to 4×
In field data from about 100,000 disks, a second failure during a rebuild was two to four times more likely than simple models predict. A rebuild is the hardest work an array ever does, and it lands on drives with the same age and wear.
The reader only sees the text you paste. Makers count SMART values differently: some Seagate raw values look alarming on healthy drives, and some SSDs report sector counts their own way, so the reader judges only the attributes named above and ignores the rest. Hardware RAID controllers, Windows Storage Spaces and Unraid are not read here; for their messages, use the message decoder.
More about this tool
Every command on this page only reads. Run them over SSH on the NAS or server, copy everything from the command line down, and paste it into the reader. You can paste several outputs one after another: the reader works out which command each part came from.
sudo -i after you sign in to work as root; QNAP suggests the same step if your account lacks permission. Synology and TrueNAS both advise turning SSH on only when you need it, so switch it off again when you are finished.cat /proc/mdstatLists every Linux software RAID (md) array, its level and its members. The status string shows each member as U for up or _ for down, a failed member is marked (F), and a running recovery shows its progress and speed. Start here: it also gives you the array and partition names for the next two commands.
mdadm --detail /dev/md2Prints the details of one md array: its state (clean, degraded, recovering and so on), how many devices are active, failed and spare, and each member's role. Replace md2 with the name of your data array from /proc/mdstat, which also shows each array's size.
cat /proc/partitions
mdadm --examine /dev/sda3Reads the md superblock on one member and displays it, including the Events, Update Time, Device Role and Array State lines the reader compares. Run it for every member of the array, not just the one you suspect.
Do not guess the partition. The number varies by NAS maker and model, and the data partition is not always 3. List the partitions first: /proc/mdstat names each member (for example sda3[0]), and cat /proc/partitions lists every disk and partition the system knows about. If mdadm reports no md superblock, you have probably picked the wrong partition. Do not create anything over it.
smartctl -a /dev/sdaPrints all the SMART information about the drive: its identity, its overall health check, its attributes and its logs. Use the whole disk (sda, not sda3) and repeat it for every disk. smartctl -x prints more, and the reader reads that too. Drives behind a hardware RAID card need a device type, such as -d megaraid,0 or -d cciss,0, with the number changed for each drive.
zpool status -vShows each pool's state, its last scrub or resilver, and every device with its READ, WRITE and CKSUM counts; -v adds the list of files with data errors. If a pool you expected is missing, run zpool import with no options: on its own it only lists the pools available to import.
Each one writes to the disks, changes what the array believes about itself, or puts more work on a drive that may be failing. Some cannot be undone.
fsck, e2fsck or chkdsk. They check filesystems, and when they repair one they write to the disk. e2fsck's own manual says it is not, in general, safe to run on a mounted filesystem.btrfs check --repair. The btrfs manual says not to use it unless a developer or an experienced user advises it. Without --repair, btrfs check does not modify the device; with it, the tool tries to fix problems where it can.mdadm --assemble --force or --run. Force assembles the array even when some members' metadata looks out of date, and mdadm's manual warns that an array which needs it may contain data corruption. Linux normally refuses to start a RAID 5 or 6 that is both dirty and degraded, because it could hold corruption nobody can detect.mdadm --create on disks that already hold an array. It writes new superblocks over the ones that record your array's layout.zpool import -f or -F, zpool clear, zpool replace. -F makes a pool importable by discarding its last few transactions, and zpool clear clears the device errors you need to read.smartctl -t on a drive that already reports errors. It starts a new self-test straight away. Let a running test finish, but do not start more.If a command asks you to confirm anything, stop there.
It reads four kinds of evidence, grades each array and each drive, and lets the worst finding set the verdict. These are the lines it pays attention to, and the rules it applies to them.
mdstat, mdadm --detail, mdadm --examine
Every member of an md array carries a superblock with an event counter and an update time. The counter goes up each time the superblock is updated, and mdadm uses it when it reassembles an array to find members that are out of sync. A member that drops out stops counting, so it is left with a lower Events number and an older Update Time than the rest.
mdadm --examine, it groups members by Array UUID, compares Events and Update Time, and lists any stale members in the order they left. Two or more events behind counts as stale; one event behind is treated as in step./proc/mdstat and mdadm --detail, it reads the status string, failed (F) and spare (S) members, the array state, and any recovery, resync or check in progress with its speed. It compares the missing members with what the array's RAID level can survive.Why it matters: --force tells mdadm to assemble the array even when some members' metadata looks out of date, and to mark members recorded as failed as working again. That is how a stale member gets pulled back in as if its older copy were current.
smartctl -a, -x or --json
smartctl shows each attribute twice: a raw count, and a normalised value the maker works out with its own formula. The reader judges the raw count. Backblaze does the same: when the raw value of any of its five key attributes is above zero, it investigates.
Unreadable sectors on a drive the array still needs are graded Stop, because a rebuild has to read the drives that are left, and an unreadable sector can stop it or leave a gap in the data. In Google's study of more than 100,000 drives, a drive was 39 times more likely to fail within 60 days after its first scan error.
| ID | Attribute | What the raw count means | How the reader grades it |
|---|---|---|---|
| 5 | Reallocated_Sector_Ct | Sectors the drive has already swapped out for spares. In Google's study, drives were over 14 times more likely to fail within 60 days after their first reallocation. | Warning. Stop if an array in the same paste is degraded or rebuilding, or if the count grows between two readings. |
| 187 | Reported_Uncorrect | Errors the drive could not recover with its own error correction. | Stop. |
| 188 | Command_Timeout | Operations aborted because the drive timed out. | Watch. |
| 197 | Current_Pending_Sector | Unstable sectors waiting to be remapped after read errors the drive could not recover. | Stop. |
| 198 | Offline_Uncorrectable | Uncorrectable errors when reading or writing a sector. | Stop. |
| 199 | UDMA_CRC_Error_Count | Errors in data transfer over the interface cable, so it points at the cable, backplane or port rather than the disk surface. | Watch. |
smartctl on NVMe drives
NVMe drives report a SMART/Health Information log instead of numbered attributes. The reader checks four of its fields:
zpool status, zpool import
zpool status lists each pool, vdev and disk with a state and READ, WRITE and CKSUM counts. DEGRADED means a vdev has lost a device but still has enough redundancy to keep working; FAULTED means it does not. A checksum error means a disk returned data that was expected to be correct, but was not.
The worst finding in the paste sets the overall verdict, which is worded to agree with the Rebuild or stop? checker.
Any one Stop finding: two or more members out, or more than the level survives; unreadable sectors on a drive the array still needs; sector counts growing between two readings; an md array that is FAILED, inactive or not started; a FAULTED pool or data errors ZFS could not repair.
One member out with nothing else wrong in the paste, a rebuild or resilver running, reallocated sectors when no array in the paste is degraded, or read and write errors on a ZFS disk.
Command timeouts, cable (CRC) errors, checksum errors with every disk still in, old or hot drives, or no scrub on record.
Every member present, zero raw counts on the attributes it checks, and pools ONLINE with no errors. A good sign, not a guarantee.
This is the reader's built-in example "Three members, one stale". The output is made up, but it is in the exact format mdadm prints. To see it live, press that button in the reader above.
What was pasted (made-up output)
The output of mdadm --examine /dev/sda1 /dev/sdb1 /dev/sdc1 on a host called nas01. All three members share Array UUID 3f1c2a9e:8b7d4c21:9a0e5f13:6d2b7c48, Raid Level raid5 and Raid Devices 3. The lines that differ:
| Member | Device Role | Events | Update Time | Array State | State |
|---|---|---|---|---|---|
| sda1 | Active device 0 | 48213 | Thu Nov 5 22:14:09 2026 | AA. | clean |
| sdb1 | Active device 1 | 48213 | Thu Nov 5 22:14:09 2026 | AA. | clean |
| sdc1 | Active device 2 | 47811 | Sun Nov 1 03:12:44 2026 | AAA | active |
What the reader says, word for word
Example reading: made-up output, not a real array · read 3 --examine
Hold off. Sort these out before any rebuild.The array is running with less protection than it was built with. Nothing here says stop yet.
What to look at
Next
A guide based on the text you pasted, not a diagnosis. It cannot see your drives, and it cannot tell you whether data is recoverable.
from mdadm --examine, 3 members compared
| Member | Role | Events | Last updated | Reading |
|---|---|---|---|---|
| sda1 | device 0 | 48,213 | Thu 5 Nov 2026, 22:14 | current |
| sdb1 | device 1 | 48,213 | Thu 5 Nov 2026, 22:14 | current |
| sdc1 | device 2 | 47,811 | Sun 1 Nov 2026, 03:12 | stale, 402 events behind |
AA. means device 2 is missing. sdc1 still says AAA because its superblock stopped being updated before the others marked it missing.A reading is a guide built from the text you paste. It is not a diagnosis, and a clean reading is not a guarantee.
In Google's study of more than 100,000 drives, over 36% of the drives that failed had zero counts on every SMART variable. Backblaze found that 23.3% of its failed drives showed no warning in the five attributes it tracks. OK means the reader found nothing wrong in what you pasted. It does not mean nothing is wrong.
The reader reads Linux software RAID (md), ZFS and drive SMART output. It does not read hardware RAID controller utilities or logs, Windows Storage Spaces or Unraid. It can judge drives behind a controller when smartctl reaches them with a device type such as -d megaraid,N, but not the controller's own view of the array. For controller and NAS messages, use the RAID controller message decoder.
It sees no kernel log, no NAS log and no history beyond two readings of the same drive. A member you do not paste is not judged. Makers turn raw SMART values into normalised ones in their own ways, so the reader judges only the attributes listed above and ignores the rest.
No grade says what can be recovered, or which files. A Stop reading means stop changing things. It does not mean the data is gone, and an OK reading does not mean a rebuild will finish.
These are the reader's own next steps for a Stop verdict:
If a rebuild or resilver is running, call before you stop it or switch anything off.
Command output says more about your systems than it seems to. The reader keeps it in your browser, and you decide what anyone else sees.
ata-WDC_WD40EFRX-68N32N0_WD-WCC7K6TR9C3D.root@yourserver), and array or pool names if they name your business.zpool status -v lists the files with data errors, and file and folder names can name clients or projects.Questions
Short answers to what people search for when an array goes degraded.
On Linux software RAID, run mdadm --examine on every member and compare two lines: Events and Update Time. Each member's event counter goes up every time its superblock is updated, and mdadm uses it on reassembly to find members that are out of sync. The member with the lowest Events and the oldest Update Time stopped being updated first. Paste every member into the reader and it puts them in order for you. Do not force that member back in: --force assembles the array even when a member's metadata looks out of date, so the older copy can be pulled back in as if it were current.
Attribute 197 counts unstable sectors that the drive could not read and is waiting to remap. Read the RAW_VALUE column, not VALUE: the normalised value comes from the maker's own formula. Backblaze treats a raw value above zero on this and four other attributes as a reason to investigate. The reader grades any pending sector on a drive the array still needs as Stop, because a rebuild has to read the drives that are left, and an unreadable sector can stop it or leave a gap in the data.
A vdev has lost a device but still has enough redundancy to keep working. The pool is still serving data, with less margin. Look at the READ, WRITE and CKSUM counts on the disks that are left: a checksum error means a disk returned data that was expected to be correct, but was not. Run zpool status -v to list any files with data errors, and write the numbers down before anyone runs zpool clear, which clears them. If the pool says FAULTED or UNAVAIL instead, do not force an import: -F discards the pool's last few transactions.
Not necessarily. A failing health status means the drive has failed or is predicting its own failure; a pass only means it has not reached that point. In Google's study, over 36% of the drives that failed had zero counts on every SMART variable, and Backblaze found 23.3% of its failed drives showed no warning in the five attributes it tracks. The reader shows PASSED as OK and still checks the raw counts.
No. It runs as a script inside this page and makes no network calls, so the text you paste is read in your browser and stays there. It stores nothing, and "Copy the reading" copies the findings only. If you share a screenshot, remove serial numbers and host names first.
Every factual claim on this page comes from one of these. All were checked on 6 November 2026.
Written and checked by Wildfire Data Recovery's Brisbane laboratory. Owner and examiner: Viktor (Dante) Burcevski, IACIS CFCE. The reader's own panel above also lists the studies behind its caution.
Related tools
A DSM version check, a 12-question exposure check, a printable first-hour card and a ransom-note decoder.
Open the checkSeven questions about your array, your backup and what has been tried, for a verdict this reader cannot give on its own.
Open the checker35 messages from 6 platforms in plain English, each linked to the vendor document it comes from.
Open the decoderMake bay labels for your drives and a short case brief for your enquiry, so every drive keeps its place.
Open the builderA one-page printed record of your array: disk order, serial numbers, RAID level, versions and contacts. Never keys.
Make a passportAll our free NAS and RAID tools in one place, with what each one does.
See all free toolsAlso free: the RAID failure simulator, which shows the point where an array stops being recoverable on its own.
When the reading says Stop
If the reader says Stop, or you are not sure, shut the array down cleanly and call. Our Brisbane lab images every member before any reconstruction work, then works from the images.