How "scrambled" is the data on a RAID5 disk?

Question

My concern is the disposal of a replaced disk from a private RAID5 disk array.

I have had to replace a disk from my personal RAID5 disk-array. It had started developing errors, so out it went.

But now, I have this disk lying on my desk and that got me wondering... The data on the array was never encrypted. I'm concerned that turning it in at the recycle-station could be a security-risk.
Is it possible that some mischievous individual would be able to retrieve personal data (photo's, files etc.) from the disk? Or is the fact that it was part of a RAID5 array sufficient for the data to have been scrambled beyond recognition?

Answer 1

In the interests of actually testing this, I pointed a copy of Foremost at a disk that was formerly part of a RAID-6 array (made available thanks to Seagate). The array had a chunk size of 512KB, so any file of 512KB or less is theoretically present intact. The data on the array is from nearly 25 years of computer use, including disk images of every computer I've owned.

The amount of data that I recovered was, frankly, scary. Word documents containing high-school homework assignments. Data files from games I'd uninstalled decades ago. DLL files from a hundred different versions of WINE. Images attached to unread Usenet posts. Ten thousand cached web pages. Adding a custom extraction rule found three SSL private keys and an SSH key.

Another thing to note is that you don't always need to extract the entire file to get compromising information. For example, the first 512k of a PDF can give you the table of contents, the first 512k of a BMP can give you a caption (BMP stores its image data upside-down), and the first 512k of a JPEG can give you a thumbnail. MPEG and MP3 files are designed to be streamable, so even a chunk from the middle of one can give someone useful data.

How scrambled is data on a RAID 5 disk? Not scrambled enough.

Answer 2

Raid 5 stripes the data across the disks but the blocks used for striping are typically pretty big. At the very least they will bewhole sectors but normally they will much larger than that. For example madm defaults to half-megabyte chunks. Even one sector is big enough that you are likely to find recongisable chunks of text and with typical chunk sizes it is quite likely entire recognisable files will be present on the individual drives from the array.

Answer 3

Sounds like people may be confusing drive sector size (typically 512B to 4KB) with RAID 5 stripe size (typically 16KB to 128KB, sometimes larger). The RAID stripe size is the logical writeable size for the array, so each part of the stripe on each drive will contain that much data. If an entire file fits into the stripe size, it will likely all be visible as a contiguous block on the remove drive.

Answer 4

A single member of a RAID 5 array will consist of plain blocks and parity blocks, for example 75% plain and 25% parity for a 4 member array. The plain blocks can be read in plain view; there is no scrambling of these blocks and you do not need to refer to other members to make sense of it. These blocks are typically 16KB to 512KB in size though with RAID-5 this is usually 128KB or below to minimise write amplification. There is plenty of scope to read sensitive data that appears in such plain blocks.

Each parity block contains data that is generated from three plain blocks on other drives, in such a way that if any of those three other drives (in a four-member array) is lost the information can be recovered by applying an algorithm to the parity block and the blocks from the other remaining two drives. The data in a parity block makes no sense and could not be recovered on its own, unless you could guess the content of two of the three other blocks it combines with - which may in some cases be easy if at least two of the three blocks were empty (zeroes) or contain predictable data. Thus while it's not cryptographically secure, the ability to extract data from a parity block on its own is unlikely to reveal anything useful except for in specific cases.

RAID 4 had a similar design to RAID 5 except that all the parity blocks were stored on one drive, so if you only had that drive, you would have no easily recoverable data. RAID 5 modified this to distribute the parity blocks evenly between members, meaning that any drive on its own will contain a lot of plain blocks from which you might recover data.

It's important to know that security of data is not a design goal in RAID and if you need it, you should implement it on another level.

Answer 5

Or is the fact that it was part of a RAID5 array sufficient for the data to have been scrambled beyond recognition?

Rule of thumb would be to always secure erase magnetic media before giving it away under such circumstances (recycling, donation, etc.). Don't make any assumptions about the underlying data, whether it was encrypted, whether it was RAID0 or RAID 5, etc.

Even if contemporary wisdom is that something is secure, experience has shown us that such beliefs can be invalidated in the future (e.g. look at the number of years the Spectre/Meltdown security issues existed undetected, until researchers discovered how that could misuse processors' behaviour).

Answer 6

In the data centers that I work in we take data security very seriously. If the drive was part of an array that was not encrypted yes there is still enough data that can be retrieved from the drive. I would honestly recommend either scrubbing the drive if it is still functional or if it is not functional I recommend degaussing the drive with some sort of controlled magnetic device.