HELP - Re-construct...
 
Notifications
Clear all

HELP - Re-constructing RAID in Encase Synology NAS (DS1512+)

9 Posts
4 Users
0 Likes
980 Views
(@glennyboy)
Posts: 6
Active Member
Topic starter
 

Hi All,

Assistance would be greatly appreaciated in reconstructing a RAID.

I was handed a 5 bay NAS (Synology DS1512+). Each bay contains a 2TB HDD. I have imaged all drives and created and E01.

Not knowing the RAID configuration, order, striping size, etc I have tried to use the following applications, RAID Reconstructor and ReclaiMe. The Enscript titled, RAID Analyser in Encase ver 6 does not have any successful results, all failed.

Any assistance on how to proceed beyond this point?

Thanks in advance

 
Posted : 13/10/2015 8:18 am
(@shark007)
Posts: 3
New Member
 

Hi,
I strongly recommend trying ReclaimePro(just Google it..) or even the free version of Reclaime….Just mount each of your E01 image using FTK Imager….. it does a great job. I recently reconstructed half a dozen of RAID of various flavors and had no problem detecting and imaging the Raid container.

 
Posted : 13/10/2015 4:07 pm
(@glennyboy)
Posts: 6
Active Member
Topic starter
 

Hi,
I strongly recommend trying ReclaimePro(just Google it..) or even the free version of Reclaime….Just mount each of your E01 image using FTK Imager….. it does a great job. I recently reconstructed half a dozen of RAID of various flavors and had no problem detecting and imaging the Raid container.

Thanks for your response shark007 but I am using the free version of Reclaime and it didn't help. I will try and persist with it tomorrow and see what happens. To be honest I was trying to play with the other product RAID Reconstructor.

Question, does Reclaime like the Linux based/built RAIDs?

 
Posted : 13/10/2015 4:20 pm
(@shark007)
Posts: 3
New Member
 

Yes Reclaime PROit does deal with Linux RAID. Now, it is possible that the free version may not detect as many kind of RAID than the paid version. I used the paid version to recover the Linux Raid and had no problem.

The other option of course would be to clone your drives and connect them all to a PC and boot with Raptor Forensics. Or I suppose you could also to in VM. I used Raptor to detect Raid and image the Raid container.

Hope this helps.

 
Posted : 13/10/2015 5:56 pm
(@deltron)
Posts: 125
Estimable Member
 

I had to do this back in the day, ill try to find what i did.

I just remeber i had an image of each drive blown back to a hard drive, so a linux vm with both drive connected. There a command to mount it in linux, trying to find the article online. But search mounting synology raid in linux.

Sorry couldn't help if i find the info i used will update.

 
Posted : 13/10/2015 7:04 pm
(@glennyboy)
Posts: 6
Active Member
Topic starter
 

Yes Reclaime PROit does deal with Linux RAID. Now, it is possible that the free version may not detect as many kind of RAID than the paid version. I used the paid version to recover the Linux Raid and had no problem.

The other option of course would be to clone your drives and connect them all to a PC and boot with Raptor Forensics. Or I suppose you could also to in VM. I used Raptor to detect Raid and image the Raid container.

Hope this helps.

I downloaded the ReclaiMe Pro last night and used it today but it would not detect the settings. I have since created a support ticket with the vendor. -(

 
Posted : 15/10/2015 6:33 am
(@glennyboy)
Posts: 6
Active Member
Topic starter
 

Yes Reclaime PROit does deal with Linux RAID. Now, it is possible that the free version may not detect as many kind of RAID than the paid version. I used the paid version to recover the Linux Raid and had no problem.

The other option of course would be to clone your drives and connect them all to a PC and boot with Raptor Forensics. Or I suppose you could also to in VM. I used Raptor to detect Raid and image the Raid container.

Hope this helps.

I have run ReclaiMe Pro, and plugged the two hard drives into a USB port via write blockers.
ReclaiMe Pro has detected a RAID 0 - LDM Partition 6 and LDM Partition 7.

How would I replicate this RAID in Encase? I still need to obtain stripe size, etc. Do I simply click on Entropy Analysis and let it run its course? It appears it will take a while to run.

Thanks for your help!

 
Posted : 20/10/2015 10:53 am
jaclaz
(@jaclaz)
Posts: 5133
Illustrious Member
 

Wait a minute, a two-partition RAID 0 out of five disks? 😯
A peculiar setup IMHO.

jaclaz

 
Posted : 20/10/2015 9:17 pm
(@shark007)
Posts: 3
New Member
 

At this point, you should be able to see and point in Reclaime Pro to the `Raid container`including those two partitions. The way you described what you see, it is very likely you are dealing with mirror drives. If you are not sure, just select the option on the right to image each container/partitions in a Raw format or VHD or VHDX. Then use your favorite tool (in my case, XWays beats everybody out there by a mile…) to open up the container and look what is inside.

You could also use Reclaime Pro to actually scan those partitions and see what is inside and recover from Reclaime Pro as well…

Hope this helps

 
Posted : 20/10/2015 10:35 pm
Share: