Skip to main content
24/7 emergency lineFree diagnosis on eligible standard recoveriesFREE Postage Label, Australia-wide
WildfireData Recovery
No Data, No Fee policyNo success fee unless we recover your data

Free tool: RAID evidence reader

Paste your array's evidence.
Read it before you rebuild.

Paste what your RAID or NAS array and its drives report. The reader picks out the lines that matter, grades each finding OK, Watch, Warning or Stop, and gives a cautious call on whether a rebuild is worth the risk.

Last checked

  • Runs in your browser, nothing uploaded
  • Built by our Brisbane recovery lab
  • Sources listed

Tool

Paste what your array says. Get a plain-English reading.

RAID calculators work from spec sheets. This reader works from your own array. Paste the text from cat /proc/mdstat, mdadm, smartctl or zpool status and it picks out the lines that matter, grades each array and drive as OK, Watch, Warning or Stop, and gives a cautious call on whether a rebuild is worth the risk.

It works out which member left the array first, spots unreadable sectors on the drives a rebuild would lean on, and reads ZFS pool states. The reading happens in your browser: nothing you paste is sent anywhere.

Array evidence readerReads mdstat, mdadm, smartctl and zpool output. Nothing is uploaded.

One output or several, one after another. Shell prompts and blank lines are fine: the reader works out which command each part came from and updates as you paste.

Your pasted text never leaves this page. Remove serial numbers first if you plan to share a screenshot.

Try an example (made-up output, clearly marked)

Which commands to run (they only read)

Run these over SSH as an admin. On Synology and QNAP, type sudo -i first. None of them changes anything on the disks.

cat /proc/mdstat
mdadm --detail /dev/md0
mdadm --examine /dev/sda1 /dev/sdb1 /dev/sdc1
smartctl -x /dev/sda
zpool status -v

Run mdadm --examine and smartctl for every member: use the partition and disk names that /proc/mdstat lists. Newer Synology units name disks /dev/sata1, /dev/sata2 and so on.

Drives behind a Dell PERC or Broadcom MegaRAID card: smartctl -x -d megaraid,0 /dev/sda, changing the number for each drive. HPE Smart Array: -d cciss,0.

Do not run anything that writes: no mdadm --create or --assemble --force, no fsck or chkdsk, no zpool import -f, zpool clear or zpool replace. If a command asks you to confirm, stop there.

Waiting for output

Your reading appears here

Paste the output of one of the commands on the left, or try an example. The verdict comes first, then what each array and drive is saying.

Rebuild or stop? checker RAID controller message decoder

A guide based on the text you paste, not a diagnosis. It cannot see your drives, a hardware RAID controller or the kernel log, and it cannot tell you whether data is recoverable. When in doubt, stop and ask: a rebuild that fails part-way is much harder to recover than one that was never started.

Honest limits

A clean reading is not a guarantee.

SMART and RAID status are the drives and the array describing themselves. They catch a lot, and they miss a lot. These are the figures behind the reader's caution.

39×

The first unreadable sector matters, but silence proves little

In Google's study of more than 100,000 drives, a drive was 39 times more likely to fail within 60 days after its first scan error. That is why pending and uncorrectable sectors mean Stop here. Yet more than 36% of the drives that failed had shown no SMART warning at all.

23.3%

The five best warning signs still miss some failures

Backblaze watches the same five SMART values this reader checks first: 5, 187, 188, 197 and 198. In its fleet, 23.3% of the drives that failed showed none of the five beforehand.

2 to 4×

Second failures cluster around the first

In field data from about 100,000 disks, a second failure during a rebuild was two to four times more likely than simple models predict. A rebuild is the hardest work an array ever does, and it lands on drives with the same age and wear.

The reader only sees the text you paste. Makers count SMART values differently: some Seagate raw values look alarming on healthy drives, and some SSDs report sector counts their own way, so the reader judges only the attributes named above and ignores the rest. Hardware RAID controllers, Windows Storage Spaces and Unraid are not read here; for their messages, use the message decoder.

More about this tool

How to collect the output, without changing anything.

Every command on this page only reads. Run them over SSH on the NAS or server, copy everything from the command line down, and paste it into the reader. You can paste several outputs one after another: the reader works out which command each part came from.

Before you start

  • You need SSH and an administrator account. On Synology, QNAP and TrueNAS, SSH is switched on in the admin interface and you sign in with an administrator account. On Synology, type sudo -i after you sign in to work as root; QNAP suggests the same step if your account lacks permission. Synology and TrueNAS both advise turning SSH on only when you need it, so switch it off again when you are finished.
  • Change nothing to get a reading. No reboot, no pulling drives, no swapping bays, no new disks.
  • A rebuild or resilver is already running? Leave it running. Do not stop it, reboot or pull a disk without advice: call 1300 806 557 first.
  • Ransom note or renamed files? This is not the first step. Start with the NAS ransomware check.
  1. Array summary

    Reads only
    cat /proc/mdstat

    Lists every Linux software RAID (md) array, its level and its members. The status string shows each member as U for up or _ for down, a failed member is marked (F), and a running recovery shows its progress and speed. Start here: it also gives you the array and partition names for the next two commands.

  2. One array in detail

    Reads only
    mdadm --detail /dev/md2

    Prints the details of one md array: its state (clean, degraded, recovering and so on), how many devices are active, failed and spare, and each member's role. Replace md2 with the name of your data array from /proc/mdstat, which also shows each array's size.

  3. Each member's own record

    Reads only
    cat /proc/partitions
    mdadm --examine /dev/sda3

    Reads the md superblock on one member and displays it, including the Events, Update Time, Device Role and Array State lines the reader compares. Run it for every member of the array, not just the one you suspect.

    Do not guess the partition. The number varies by NAS maker and model, and the data partition is not always 3. List the partitions first: /proc/mdstat names each member (for example sda3[0]), and cat /proc/partitions lists every disk and partition the system knows about. If mdadm reports no md superblock, you have probably picked the wrong partition. Do not create anything over it.

  4. Drive health

    Reads only
    smartctl -a /dev/sda

    Prints all the SMART information about the drive: its identity, its overall health check, its attributes and its logs. Use the whole disk (sda, not sda3) and repeat it for every disk. smartctl -x prints more, and the reader reads that too. Drives behind a hardware RAID card need a device type, such as -d megaraid,0 or -d cciss,0, with the number changed for each drive.

  5. ZFS pools

    Reads only
    zpool status -v

    Shows each pool's state, its last scrub or resilver, and every device with its READ, WRITE and CKSUM counts; -v adds the list of files with data errors. If a pool you expected is missing, run zpool import with no options: on its own it only lists the pools available to import.

Never run these while you are working out what happened

Each one writes to the disks, changes what the array believes about itself, or puts more work on a drive that may be failing. Some cannot be undone.

  • fsck, e2fsck or chkdsk. They check filesystems, and when they repair one they write to the disk. e2fsck's own manual says it is not, in general, safe to run on a mounted filesystem.
  • btrfs check --repair. The btrfs manual says not to use it unless a developer or an experienced user advises it. Without --repair, btrfs check does not modify the device; with it, the tool tries to fix problems where it can.
  • mdadm --assemble --force or --run. Force assembles the array even when some members' metadata looks out of date, and mdadm's manual warns that an array which needs it may contain data corruption. Linux normally refuses to start a RAID 5 or 6 that is both dirty and degraded, because it could hold corruption nobody can detect.
  • mdadm --create on disks that already hold an array. It writes new superblocks over the ones that record your array's layout.
  • zpool import -f or -F, zpool clear, zpool replace. -F makes a pool importable by discarding its last few transactions, and zpool clear clears the device errors you need to read.
  • The NAS's own Repair, Initialise or Rebuild buttons. On a Synology, Repair rebuilds a degraded pool onto a replacement drive, and everything already on that drive is erased.
  • smartctl -t on a drive that already reports errors. It starts a new self-test straight away. Let a running test finish, but do not start more.
  • Stopping a rebuild that is already running. Call 1300 806 557 first: stopping one part-way has its own risks.

If a command asks you to confirm anything, stop there.

What the reader looks for.

It reads four kinds of evidence, grades each array and each drive, and lets the worst finding set the verdict. These are the lines it pays attention to, and the rules it applies to them.

mdstat, mdadm --detail, mdadm --examine

Linux software RAID: which member left first

Every member of an md array carries a superblock with an event counter and an update time. The counter goes up each time the superblock is updated, and mdadm uses it when it reassembles an array to find members that are out of sync. A member that drops out stops counting, so it is left with a lower Events number and an older Update Time than the rest.

  • From mdadm --examine, it groups members by Array UUID, compares Events and Update Time, and lists any stale members in the order they left. Two or more events behind counts as stale; one event behind is treated as in step.
  • It also flags a superblock checksum that does not match, a member that was only part-way through a rebuild, recorded bad blocks, and two members claiming the same slot.
  • From /proc/mdstat and mdadm --detail, it reads the status string, failed (F) and spare (S) members, the array state, and any recovery, resync or check in progress with its speed. It compares the missing members with what the array's RAID level can survive.
  • Small RAID 1 arrays mirrored across every bay are recognised as the NAS's own system or swap partitions and are not counted against your data array.

Why it matters: --force tells mdadm to assemble the array even when some members' metadata looks out of date, and to mark members recorded as failed as working again. That is how a stale member gets pulled back in as if its older copy were current.

smartctl -a, -x or --json

SATA and SAS drives: SMART counts, read as raw values

smartctl shows each attribute twice: a raw count, and a normalised value the maker works out with its own formula. The reader judges the raw count. Backblaze does the same: when the raw value of any of its five key attributes is above zero, it investigates.

Unreadable sectors on a drive the array still needs are graded Stop, because a rebuild has to read the drives that are left, and an unreadable sector can stop it or leave a gap in the data. In Google's study of more than 100,000 drives, a drive was 39 times more likely to fail within 60 days after its first scan error.

  • Overall health check FAILED, an attribute failing now, or a failed most recent self-test: Stop.
  • Uncorrectable (UNC) entries in the drive's error log: Warning. Over about three years of power-on time, or running hot: Watch.
  • SAS drives: blocks in the grown defect list are graded like reallocated sectors, and uncorrected read, write or verify errors like pending sectors.
  • Two readings of the same drive, matched by serial number: a count that grows between them is Stop.
  • The drive the array has already dropped (matched by device name or serial number) is expected to show problems, so its errors are shown as Warning and not counted against the drives that are left.
The six SMART attributes the reader judges, by raw value
IDAttributeWhat the raw count meansHow the reader grades it
5Reallocated_Sector_CtSectors the drive has already swapped out for spares. In Google's study, drives were over 14 times more likely to fail within 60 days after their first reallocation.Warning. Stop if an array in the same paste is degraded or rebuilding, or if the count grows between two readings.
187Reported_UncorrectErrors the drive could not recover with its own error correction.Stop.
188Command_TimeoutOperations aborted because the drive timed out.Watch.
197Current_Pending_SectorUnstable sectors waiting to be remapped after read errors the drive could not recover.Stop.
198Offline_UncorrectableUncorrectable errors when reading or writing a sector.Stop.
199UDMA_CRC_Error_CountErrors in data transfer over the interface cable, so it points at the cable, backplane or port rather than the disk surface.Watch.

smartctl on NVMe drives

NVMe drives: the health log

NVMe drives report a SMART/Health Information log instead of numbered attributes. The reader checks four of its fields:

  • Critical Warning: any flag set. The flags cover spare capacity below its threshold, temperature, degraded reliability, media switched to read-only and a failed volatile memory backup. Spare, reliability or read-only is Stop; a temperature or backup warning is Warning.
  • Media and Data Integrity Errors: times the drive detected an unrecovered data integrity error. Above zero is Stop.
  • Available Spare at or below its threshold: Stop.
  • Percentage Used, the maker's estimate of how much of the drive's life is used: 80% or more is Watch, 100% or more is Warning.

zpool status, zpool import

ZFS: pool state, disks out, and CKSUM

zpool status lists each pool, vdev and disk with a state and READ, WRITE and CKSUM counts. DEGRADED means a vdev has lost a device but still has enough redundancy to keep working; FAULTED means it does not. A checksum error means a disk returned data that was expected to be correct, but was not.

  • Pool FAULTED, UNAVAIL or SUSPENDED: Stop.
  • Disks out (FAULTED, UNAVAIL, REMOVED or OFFLINE) are counted per vdev against what it can lose: all but one disk of a mirror, one for raidz1, two for raidz2, three for raidz3. More than that, or two or more out: Stop. One out: Warning, or Stop if no redundancy is left and a disk that is left is also logging errors.
  • READ or WRITE errors on a disk: Warning. Checksum errors alone, with nothing out: Watch.
  • Permanent errors, data errors, or a scrub or resilver that finished with errors it could not repair: Stop. A resilver in progress: Warning.

How the verdict is set

The worst finding in the paste sets the overall verdict, which is worded to agree with the Rebuild or stop? checker.

Stop

"Stop. Do not rebuild, repair or force anything."

Any one Stop finding: two or more members out, or more than the level survives; unreadable sectors on a drive the array still needs; sector counts growing between two readings; an md array that is FAILED, inactive or not started; a FAULTED pool or data errors ZFS could not repair.

Warning

"Hold off. Sort these out before any rebuild."

One member out with nothing else wrong in the paste, a rebuild or resilver running, reallocated sectors when no array in the paste is degraded, or read and write errors on a ZFS disk.

Watch

"Nothing here says stop. Keep an eye on these."

Command timeouts, cable (CRC) errors, checksum errors with every disk still in, old or hot drives, or no scrub on record.

OK

"Nothing in what you pasted says stop."

Every member present, zero raw counts on the attributes it checks, and pools ONLINE with no errors. A good sign, not a guarantee.

Three members, one stale: reading mdadm --examine.

This is the reader's built-in example "Three members, one stale". The output is made up, but it is in the exact format mdadm prints. To see it live, press that button in the reader above.

What was pasted (made-up output)

The output of mdadm --examine /dev/sda1 /dev/sdb1 /dev/sdc1 on a host called nas01. All three members share Array UUID 3f1c2a9e:8b7d4c21:9a0e5f13:6d2b7c48, Raid Level raid5 and Raid Devices 3. The lines that differ:

Lines that differ between the three members
MemberDevice RoleEventsUpdate TimeArray StateState
sda1Active device 048213Thu Nov 5 22:14:09 2026AA.clean
sdb1Active device 148213Thu Nov 5 22:14:09 2026AA.clean
sdc1Active device 247811Sun Nov 1 03:12:44 2026AAAactive

What the reader says, word for word

Example reading: made-up output, not a real array · read 3 --examine

Hold off. Sort these out before any rebuild.

The array is running with less protection than it was built with. Nothing here says stop yet.

What to look at

  • Array nas01:0 · RAID 5: sdc1 left first, 402 events behind

Next

  • If you do not have a current, tested backup, stop writing to the array and have every drive imaged before any rebuild.
  • If you do have one, restore a few files from it first, replace only the drive the system marks as failed (match its bay and serial number), and stop at the first new warning.
  • Paste smartctl for every remaining member: a rebuild leans hardest on the drives that are left.
  • For a verdict that also weighs your backup and what has already been tried, answer the questions in the rebuild-or-stop checker.

A guide based on the text you pasted, not a diagnosis. It cannot see your drives, and it cannot tell you whether data is recoverable.

Warning

Array nas01:0 · RAID 5

from mdadm --examine, 3 members compared

Array UUID
3f1c2a9e:8b7d4c21:9a0e5f13:6d2b7c48
Level
RAID 5
Raid devices
3
Newest Array State
AA.
Metadata
1.2
  • Warningsdc1 stopped being updated on Sun 1 Nov 2026, 03:12. sda1 and sdb1 carried on for 402 more events, about 4 days 19 hours longer. That makes sdc1 the member most likely to have dropped out first. Its copy of the array is older than the rest, so it must not be forced back in or treated as current.
  • OKsda1 and sdb1 agree: Events 48,213, last updated Thu 5 Nov 2026, 22:14. They hold the most recent state of the array.
Members compared
MemberRoleEventsLast updatedReading
sda1device 048,213Thu 5 Nov 2026, 22:14current
sdb1device 148,213Thu 5 Nov 2026, 22:14current
sdc1device 247,811Sun 1 Nov 2026, 03:12stale, 402 events behind

How to read it yourself

  1. Match the members. The same Array UUID means the same array, so all three belong together.
  2. Compare Events. sda1 and sdb1 are at 48213. sdc1 stopped at 47811, 402 events behind.
  3. Compare Update Time. sdc1 was last written on Sunday 1 November at 03:12. The other two carried on until Thursday 5 November at 22:14.
  4. Read Array State from the newest members. AA. means device 2 is missing. sdc1 still says AAA because its superblock stopped being updated before the others marked it missing.
  5. So sdc1 left first. One member out of a RAID 5 leaves the array running with no spare protection, which is why the reader says Hold off rather than Stop. A second member out, or unreadable sectors on sda or sdb, would turn it into Stop.
  6. Next, paste smartctl for sda and sdb. A rebuild would lean on those two drives for every sector.
What the reader cannot tell you.

A reading is a guide built from the text you paste. It is not a diagnosis, and a clean reading is not a guarantee.

SMART misses many failures

In Google's study of more than 100,000 drives, over 36% of the drives that failed had zero counts on every SMART variable. Backblaze found that 23.3% of its failed drives showed no warning in the five attributes it tracks. OK means the reader found nothing wrong in what you pasted. It does not mean nothing is wrong.

It cannot see hardware RAID controllers

The reader reads Linux software RAID (md), ZFS and drive SMART output. It does not read hardware RAID controller utilities or logs, Windows Storage Spaces or Unraid. It can judge drives behind a controller when smartctl reaches them with a device type such as -d megaraid,N, but not the controller's own view of the array. For controller and NAS messages, use the RAID controller message decoder.

It only knows what you paste

It sees no kernel log, no NAS log and no history beyond two readings of the same drive. A member you do not paste is not judged. Makers turn raw SMART values into normalised ones in their own ways, so the reader judges only the attributes listed above and ignores the rest.

It cannot tell you whether data is recoverable

No grade says what can be recovered, or which files. A Stop reading means stop changing things. It does not mean the data is gone, and an OK reading does not mean a rebuild will finish.

If the reading says Stop

These are the reader's own next steps for a Stop verdict:

  1. Stop using the array. If it is still running, shut it down from its admin page, or with the maker's short power-button press, never at the wall. If there is a ransom note, call first.
  2. Do not rebuild, repair, initialise or swap drives.
  3. Label each drive with its bay number before anything is removed.
  4. Then call 1300 806 557 or send the enquiry, and we will plan the imaging with you.

If a rebuild or resilver is running, call before you stop it or switch anything off.

Your output stays on your screen.

Command output says more about your systems than it seems to. The reader keeps it in your browser, and you decide what anyone else sees.

What the reader does with it

  • It runs as a script inside this page. The text you paste is read in your browser and is not sent anywhere.
  • It does not save your text: no cookies, no browser storage. Clear the box or close the page and it is gone.
  • "Copy the reading" copies the findings only, never the text you pasted.

Before you share a screenshot

  • Remove serial numbers. smartctl prints one on its Serial Number line, and ZFS device names can contain one, as in ata-WDC_WD40EFRX-68N32N0_WD-WCC7K6TR9C3D.
  • Remove host names from the prompt (root@yourserver), and array or pool names if they name your business.
  • Check file paths. zpool status -v lists the files with data errors, and file and folder names can name clients or projects.
  • Keep an unedited copy for yourself and for whoever handles the recovery. The serial numbers are how each drive is matched to its bay.

Questions

Common questions.

Short answers to what people search for when an array goes degraded.

  1. Which drive failed first in my RAID array?

    On Linux software RAID, run mdadm --examine on every member and compare two lines: Events and Update Time. Each member's event counter goes up every time its superblock is updated, and mdadm uses it on reassembly to find members that are out of sync. The member with the lowest Events and the oldest Update Time stopped being updated first. Paste every member into the reader and it puts them in order for you. Do not force that member back in: --force assembles the array even when a member's metadata looks out of date, so the older copy can be pulled back in as if it were current.

  2. What does Current_Pending_Sector mean in smartctl?

    Attribute 197 counts unstable sectors that the drive could not read and is waiting to remap. Read the RAW_VALUE column, not VALUE: the normalised value comes from the maker's own formula. Backblaze treats a raw value above zero on this and four other attributes as a reason to investigate. The reader grades any pending sector on a drive the array still needs as Stop, because a rebuild has to read the drives that are left, and an unreadable sector can stop it or leave a gap in the data.

  3. zpool status says DEGRADED. What does that mean?

    A vdev has lost a device but still has enough redundancy to keep working. The pool is still serving data, with less margin. Look at the READ, WRITE and CKSUM counts on the disks that are left: a checksum error means a disk returned data that was expected to be correct, but was not. Run zpool status -v to list any files with data errors, and write the numbers down before anyone runs zpool clear, which clears them. If the pool says FAULTED or UNAVAIL instead, do not force an import: -F discards the pool's last few transactions.

  4. SMART says PASSED. Is the drive healthy?

    Not necessarily. A failing health status means the drive has failed or is predicting its own failure; a pass only means it has not reached that point. In Google's study, over 36% of the drives that failed had zero counts on every SMART variable, and Backblaze found 23.3% of its failed drives showed no warning in the five attributes it tracks. The reader shows PASSED as OK and still checks the raw counts.

  5. Does the reader send my output anywhere?

    No. It runs as a script inside this page and makes no network calls, so the text you paste is read in your browser and stays there. It stores nothing, and "Copy the reading" copies the findings only. If you share a screenshot, remove serial numbers and host names first.

Sources.

Every factual claim on this page comes from one of these. All were checked on 6 November 2026.

  1. How can I sign in to DSM/SRM with root privilege via SSH? Synology Knowledge Center.
  2. How do I access my QNAP NAS using SSH? QNAP.
  3. Configuring SSH Service. TrueNAS documentation.
  4. Mdstat. Linux RAID wiki, archived at kernel.org.
  5. mdadm(8): manage MD devices aka Linux Software RAID. Linux manual page, man7.org.
  6. The /proc Filesystem. Linux kernel documentation.
  7. smartctl(8): control and monitor utility for SMART disks. smartmontools manual page, Debian.
  8. zpool-status(8). OpenZFS documentation.
  9. zpool-import(8). OpenZFS documentation.
  10. e2fsck(8). Linux manual page, man7.org.
  11. btrfs-check(8). BTRFS documentation.
  12. Repair a Storage Pool. Synology Knowledge Center (DSM 7).
  13. RAID arrays. Linux kernel documentation.
  14. zpool-clear(8). OpenZFS documentation.
  15. RAID superblock formats. Linux RAID wiki, archived at kernel.org.
  16. Self-Monitoring, Analysis and Reporting Technology (S.M.A.R.T.), table of known attributes. Wikipedia.
  17. What SMART Stats Tell Us About Hard Drives. Backblaze.
  18. Failure Trends in a Large Disk Drive Population. Pinheiro, Weber and Barroso, USENIX FAST 2007.
  19. nvme_smart_log(2): SMART / Health Information Log. libnvme manual page, Ubuntu.
  20. zpoolconcepts(7). OpenZFS documentation.
  21. nvme_smart_crit(2): Critical Warning. libnvme manual page, Ubuntu.
  22. Disk Failures in the Real World. Schroeder and Gibson, USENIX FAST 2007.

When the reading says Stop

Talk to us before anything else touches the disks.

If the reader says Stop, or you are not sure, shut the array down cleanly and call. Our Brisbane lab images every member before any reconstruction work, then works from the images.