±Forensic Focus Partners

±Your Account


Nickname
Password


Forgotten password/username?


Membership:
New Today: 5
New Yesterday: 4
Overall: 27628
Visitors: 51

±Follow Forensic Focus

Join our LinkedIn group

Subscribe to news

Subscribe to forums

Subscribe to blog

Subscribe to tweets

"RAID" help!

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Go to page 1, 2  Next 
  

"RAID" help!

Post Posted: Wed Jul 30, 2014 1:04 pm

I am working a case with a Dell Power Edge T300. Service Tag#:B27G1L1. It contains 3 250 GB hard drives. Here is the info from the Dell site using this tag #:

System summary

Service Tag

B27G1L1

Computer Model

PowerEdge T300

Shipping Date

10/26/2009

Country

United States

Components

Part Number

Quantity

Description

R708H

1

PROCESSOR, X3323, 2.5/1.3, 6M, XUP, E0

KJ582

1

HEATSINK, PLASTIC GRID ARRAY, 2.5X3.5X4.27

C584K

1

Overpack Kit, WS8XBP, english

0R215

2

CORD, POWER, 15A, 125V, 10, 5-15/C13

PD147

1

ASSEMBLY, CABLE, LIGHT EMITTING DIODE, HARD DRIVE, AUXILIARY, PRECISION WORKSTATION, 490

70P6G

1

Assembly, Digital Video Disk Drive, 16X, Serial Ata, Half Height, Hitachi Lg Data Storage, Enterprise Systems Group

J105C

3

ASSEMBLY, CARRIER, HARD DRIVE, Serial ATA, 1IN

NT154

2

Assembly, Power Supply Redundant, 528W, DLT

H7511

2

ASSEMBLY, CARRIER, BLANK , HARD DRIVE, UNIVERSAL, 1IN, 2

F420T

3

HARD DRIVE, 250G, ES3, 7.2K, 3.5, V2, SEAGATE, MAGNETO OPTICAL DRIVE

KP010

1

ASSEMBLY, CHASSIS, HOT PLUG, REDUNDANT, T300

T774H

1

PRINTED WIRING ASSY, CONTROLLER, PERIPHERAL COMPONENT INTERCONNECT EXPRESS , SERIAL ATTACHED SCSI, PERC6/I, ADAPTER

K278H

1

ASSEMBLY, CABLE, Serial ATA, MOTHERBOARD, OPTICAL DEVICE DRIVE, STATE AND LOCAL GOVERNMENT, T300

X3959

1

Card, Network, PERIPHERAL COMPONENT INTERCONNECT EXPRESS , COPPER, DUAL PORT

WP130

2

DUAL IN-LINE MEMORY MODULE, 2G, 667M, 256X72, 8, 240, 2RX8

GG460

1

KIT, STRAIN RELIEF, CABLE, POWER

NP393

1

ASSEMBLY, CABLE, POWEREDGE EXPANDABLE RAID CONTROLLER NUMBER, BTTRY, T300

I have imaged all three of the hard drives separately (E01s) and loaded them into EnCase 6. I haven't been able to find much information about the presumable "RAID" set up. I went into the BIOS and the only info I can find is that it may be a RAID 5. I have the RAID analyzer and RAID Source Disk Sector Locator EnScripts but without the RAID info I haven't been able to use them. The system is running Windows SBS Premium 2008. Looking at the info of the three hard drives through EnCase, I haven’t been able to determine which hard drive is the primary with an OS. Where do I go from here? I found no more info on Dell's site than what I listed here. I think I have read every post I can find on several sites and am still stuck.



I am prepared to do a live acquisition but was giving this a go first.



Thank



Jim  

jbarber
Newbie
 
 
  

Re: "RAID" help!

Post Posted: Wed Jul 30, 2014 1:49 pm

Are you trying to rebuild the raid in encase?
You may have to guess the order, and use popular stripe sizes, well thats what i was told from guidance support when i was in the same situation.  

Deltron
Member
 
 
  

Re: "RAID" help!

Post Posted: Wed Jul 30, 2014 2:10 pm

Yes I am trying to rebuild the RAID with EnCase. Yeah using the "Edit Disk Configuration" is a little confusing. Did you have any luck with your case?  

jbarber
Newbie
 
 
  

Re: "RAID" help!

Post Posted: Wed Jul 30, 2014 4:05 pm

Find the $MFT - this is the best guidance for stripe and order and parity. A $MFT is normally reasonably sequential so very good for raid analysis.

This is assuming it is an NTFS disk
_________________
Michael Cotgrove
www.cnwrecovery.com
cnwrecovery.blogspot.com/ 

mscotgrove
Senior Member
 
 
  

Re: "RAID" help!

Post Posted: Wed Jul 30, 2014 6:29 pm

A former colleague of mine bought this tool a couple of weeks ago and hasn't stopped raving about it since

Code:
http://www.diskinternals.com/raid-recovery/

I've not used it personally but he told me it was pretty much automated and does what it says on the box. Might be worth a try..  

Adam10541
Senior Member
 
 
  

Re: "RAID" help!

Post Posted: Wed Jul 30, 2014 7:35 pm

PRINTED WIRING ASSY, CONTROLLER, PERIPHERAL COMPONENT INTERCONNECT EXPRESS , SERIAL ATTACHED SCSI, PERC6/I, ADAPTER

If you can get into the controller software (typically Ctrl-R) you should see the stored settings.

When you unplugged the drives you should have noted the order. The controller software orders the discs as 0,1,2 by default.

The default stripe size for the PERC6I is: Stripe Element Size – Default value is 64KB
www.thegeekstuff.com/2...n-utility/

RAID Reconstructor V4.32 is another good choice for the price. www.runtime.org/raid.htm  

BitHead
Senior Member
 
 
  

Re: "RAID" help!

Post Posted: Fri Aug 01, 2014 3:23 am

Another vote for Runtime software, only had to use it once but worked a charm on RAID0

Cheers  

Cults14
Senior Member
 
 
Reply to topicReply to topic

Share this forum topic to encourage more replies



Page 1 of 2
Go to page 1, 2  Next