±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 36312
New Yesterday: 7 Visitors: 157

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

Qnap array

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Page Previous  1, 2, 3  Next 
  

jaclaz
Senior Member
 

Re: Qnap array

Post Posted: Jul 28, 13 16:18

- bombone
ok the answer is RAID 6

Which is on one side a good thing (there is more parity data when compared to a RAID 5 and in theory the array can be recovered with two disks failed in most configurations) on the other side there are more configurations possible and the recovery process/algorithm is more complex (and needs to be adapted to the specific configuration).
Still if the "technician" already attempted a rebuilding on the array and failed, this may have caused "damages", but more than that, your failed attempt at imaging might mean that a third disk had issues (and possibly this generated errors in the rebuilding initiated when the first two were replaced), and AFAICU three failed disks is "too much" to be able to recover the array, possibly only some data can be recovered if parts of the first "third failed" disk are still readable.

jaclaz
_________________
- In theory there is no difference between theory and practice, but in practice there is. - 
 
  

bombone
Senior Member
 

Re: Qnap array

Post Posted: Jul 28, 13 21:53

- jaclaz
- bombone
ok the answer is RAID 6

Which is on one side a good thing (there is more parity data when compared to a RAID 5 and in theory the array can be recovered with two disks failed in most configurations) on the other side there are more configurations possible and the recovery process/algorithm is more complex (and needs to be adapted to the specific configuration).
Still if the "technician" already attempted a rebuilding on the array and failed, this may have caused "damages", but more than that, your failed attempt at imaging might mean that a third disk had issues (and possibly this generated errors in the rebuilding initiated when the first two were replaced), and AFAICU three failed disks is "too much" to be able to recover the array, possibly only some data can be recovered if parts of the first "third failed" disk are still readable.

jaclaz


oh thanks. Now Ftk imager on all disk. E01 or dd?
bye thanks  
 
  

jaclaz
Senior Member
 

Re: Qnap array

Post Posted: Jul 28, 13 22:15

- bombone

oh thanks. Now Ftk imager on all disk. E01 or dd?
bye thanks


dd (and not E01) but why exactly FTK imager? Question

I mean, here you are dealing with data recovery, and not data forensics.

E01 makes no sense, the "dd" or "RAW" format is the "most compatible with any software" that you can have or that you will need, as it is a 1:1 as plain as possible copy.

Tools like ddrescue (or dd_rescue):
www.garloff.de/kurt/linux/ddrescue/
or equivalent for windows, example:
www.datarescue.com/pho...3/drdd.htm
i.e. tools designed for data recovery, are way more suitable to data recovery than "forensic" disk imagers because they have normally provisions for "weak" or "slow" sectors.

A tool may manage such issues differently from other ones, like making a "chunk copy" and skip an area or replace the unreadable sectors with blank ones, but in any case they are advised.

Such data recovery imaging tools have the capability of attempting reading areas "backwards" which often gives good results.

Specifically, you already tried FTK imager on one disk and it stalled, reaching 32% after 24 hours, don't you think that trying *something else* is the case?

jaclaz
_________________
- In theory there is no difference between theory and practice, but in practice there is. - 
 
  

bombone
Senior Member
 

Re: Qnap array

Post Posted: Jul 28, 13 22:32

- jaclaz
- bombone

oh thanks. Now Ftk imager on all disk. E01 or dd?
bye thanks


dd (and not E01) but why exactly FTK imager? Question

I mean, here you are dealing with data recovery, and not data forensics.

E01 makes no sense, the "dd" or "RAW" format is the "most compatible with any software" that you can have or that you will need, as it is a 1:1 as plain as possible copy.

Tools like ddrescue (or dd_rescue):
www.garloff.de/kurt/linux/ddrescue/
or equivalent for windows, example:
www.datarescue.com/pho...3/drdd.htm
i.e. tools designed for data recovery, are way more suitable to data recovery than "forensic" disk imagers because they have normally provisions for "weak" or "slow" sectors.

A tool may manage such issues differently from other ones, like making a "chunk copy" and skip an area or replace the unreadable sectors with blank ones, but in any case they are advised.

Such data recovery imaging tools have the capability of attempting reading areas "backwards" which often gives good results.

Specifically, you already tried FTK imager on one disk and it stalled, reaching 32% after 24 hours, don't you think that trying *something else* is the case?

jaclaz

ok, many thanks i will try the softtware. you are preciuos
bye  
 
  

bombone
Senior Member
 

Re: Qnap array

Post Posted: Jul 30, 13 00:29

now the owner of the nas, said that unplugged the nas because didn't work well.
such a mess. Tomorrow i sent in white chamber  
 
  

groper128
Newbie
 

Re: Qnap array

Post Posted: Jul 30, 13 05:22

Bombone,

Has the RAID actually finished rebuilding after the two HDD replacements?  
 
  

bombone
Senior Member
 

Re: Qnap array

Post Posted: Jul 30, 13 11:30

- groper128
Bombone,

Has the RAID actually finished rebuilding after the two HDD replacements?

don't know!  
 

Page 2 of 3
Page Previous  1, 2, 3  Next