±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 3 Overall: 35980
New Yesterday: 5 Visitors: 122

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

Intel SRCU32 RAID controller

Discussion of forensic workstations, write blockers, bridges, adapters, disk duplicators, storage etc. Strictly no advertising of commercial products, please.
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Page 1, 2  Next 
  

gkelley
Senior Member
 

Intel SRCU32 RAID controller

Post Posted: Sep 20, 09 22:36

Anyone ever imaged a computer with one of these? I'm trying to put the RAID back together. The power supply was removed so we were forced to image the disks separately. there are 4 drives.
The RAID settings are actually stored on the drives but I'm having a heck of a time figuring them out. I think I have a RAID5, but I'm not 100% sure.
I've tried RAID Reconstructor and Encase's RAID analyzer script and neither gave me any help. I've tried my methods of finding the MBR and partition starts and those have only got me part way there.
Not only do I have to figure out the disk order and stripe size but also the sector that the striping starts at for each disk.
_________________
Greg Kelley, EnCE, DFCP
Vestige, Ltd
www.vestigeltd.com 
 
  

Patrick4n6
Senior Member
 

Re: Intel SRCU32 RAID controller

Post Posted: Sep 21, 09 01:39

Try PyFLAG or X-Ways.

The boys from Aust DSD gave a great demo of RAID reconstruction with PyFLAG years back at the AHTCC conference.
_________________
Tony Patrick, B. Inf Tech, CFCE
www.patrickcomputerfor...s.com/blog
www.twitter.com/Patrick4n6 
 
  

seanmcl
Senior Member
 

Re: Intel SRCU32 RAID controller

Post Posted: Sep 21, 09 01:52

Did you have all of your drives attached to a non-RAID SCSI adapter when using RAID Reconstructor?

You mentioned the RAID configuration being stored on the drive which is true. This is to support the Array Roaming Compatibility of that series of controllers but it may also indicate that there is proprietary technology involved.

However, that particular RAID controller family has an open source Linux driver. You can use the C include file to determine the size of the structures on disk which describe the RAID format (including certain strings that you can GREP for), and then search for the parameters, yourself, find the structures, and enter the data into RAID Reconstructor.

You might even make it easy on yourself and get one of the controllers and a couple of disks and create the array but don't format the logical volume(s). The documentation states that the configuration data is not visible to the user so it must be outside the file system and having an array with logical volumes which have not been formatted should make it easy to find the location of the information written to it by the controller.  
 
  

gkelley
Senior Member
 

Re: Intel SRCU32 RAID controller

Post Posted: Sep 21, 09 06:25

When I used RAID Reconstructor, I was using disk images, not the original drives.
I did read about the roaming capability, that is how I came to the conclusion as to where the RAID config is stored.
I didn't realize it was open source. Do you have a source for the source files? Reading C once I get them will be pretty easy for me.
_________________
Greg Kelley, EnCE, DFCP
Vestige, Ltd
www.vestigeltd.com 
 
  

seanmcl
Senior Member
 

Re: Intel SRCU32 RAID controller

Post Posted: Sep 21, 09 17:42

Try here:

downloadcenter.intel.c...nldID=8257

Make sure to past it all back together.  
 
  

gkelley
Senior Member
 

Re: Intel SRCU32 RAID controller

Post Posted: Sep 21, 09 18:01

Thanks
_________________
Greg Kelley, EnCE, DFCP
Vestige, Ltd
www.vestigeltd.com 
 
  

gkelley
Senior Member
 

Re: Intel SRCU32 RAID controller

Post Posted: Sep 21, 09 23:54

Well, while code does list the data structures that contain the information, it appears that the driver queries the controller for that information so I'm not sure where on the disks the controller is storing the data.
_________________
Greg Kelley, EnCE, DFCP
Vestige, Ltd
www.vestigeltd.com 
 

Page 1 of 2
Page 1, 2  Next