±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 35965
New Yesterday: 0 Visitors: 154

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

RAID imaging problem

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Page 1, 2  Next 
  

Dee33
Newbie
 

RAID imaging problem

Post Posted: Jan 17, 12 01:26

At present trying to image a HP ProLiant DL 380 GD Server
with a HP Smart Array P400 controller and Intergrated IDE Controller

Using LinEN Boot disk v6.18 - fails to boot up correctly

Any idea ????

Please note: All HDD have been imaged via FTK [6 x SAS and 2 x SATA], but also unable to configure!

Thank you in advance  
 
  

athulin
Senior Member
 

Re: RAID imaging problem

Post Posted: Jan 17, 12 02:48

- Dee33
At present trying to image a HP ProLiant DL 380 GD Server with a HP Smart Array P400 controller and Intergrated IDE Controller

Using LinEN Boot disk v6.18 - fails to boot up correctly


What's the actual failure message?

(Guessing: Does the base distribution support the controller? Should be cciss or perhaps hpsa. If neither, look for a release that does -- current mainline should do. HP also provides drivers for SUSE ... see their drivers support page.)

Please note: All HDD have been imaged via FTK [6 x SAS and 2 x SATA], but also unable to configure!


Sorry, I don't understand.

Is a live acquiry *through* the controller an option?  
 
  

Dee33
Newbie
 

Re: RAID imaging problem

Post Posted: Jan 17, 12 04:51

There is no failure message - as it turns to a blank screen

It was [without notice] hand delivered, so attempting to image via network x

GS [EnCase] own LinEN used so far

Imaged [individually] all the drives

Thanks  
 
  

athulin
Senior Member
 

Re: RAID imaging problem

Post Posted: Jan 17, 12 13:59

- Dee33
There is no failure message - as it turns to a blank screen


My first reaction was to write what follows. However, it feels like standard boilerplate that I suspect you are already aware of, so perhaps there are additional factors that come into play.

Still:

That means your standard troubleshooting procedure starts to ensure the system can support an acquiry. (You don't leave that to assumption.)

My own checklist is roughly: always check memory with a Memtest variant or MS Windows Memory Diagnostics, look for disabled diagnostics in BIOS/equivalent and enable them if possible, then reboot to run through them -- alternatively run a general health check as provided by the manufacturer (HP is bound to have something), or use the latest Ultimate Boot CD (though you really should get acquainted with those tools on a system you know first). Also, check BIOS/equivalent for special configurations, and either get rid of anything that assumes specific software configuration. Check hardware support in the OS you're using for the imaging software and disconnect or disable anything that is dubious ... and so on and so forth. If there are BIOS POST logs kept anywhere, check them out first for problems. (I don't need to say that you must keep meticulous notes, as you probably need to get everythng back in its original place.)

If you can find a system manual on the HP support site, grab it and read.

For best results, if you are not familiar with the platform, look for a tame HP ProLiant administrator -- ideally, the one that ran the system, but anyone with practical system experience of this platform and the time to sit down would be useful. (And remember to take notes -- so that next time you encounter one of these, you already know the basics.)

Computer system archaeology is usually a waste of time if you have someone who is/was involved to ask.

... and while I remember: make sure that the LinEn boot CD you mentioned really works ... and that the CD unit on the system works. (If it doesn't -- look for alternative boot solutions -- perhaps you can boot over USB?). If it is the Encase-autoproduced CD you're using, I'd suggest looking for something like Raptor or Helix 3 Pro instead, to only mention the first two that comes to mind. You still need to verify that you got the appropriate hardware drivers, though.  
 
  

BitHead
Senior Member
 

Re: RAID imaging problem

Post Posted: Jan 17, 12 18:51

What tool are you using to reassemble the individual images back into a RAID?  
 
  

Dee33
Newbie
 

Re: RAID imaging problem

Post Posted: Jan 17, 12 19:50

EnCase - but unable to config
Also MIP - RAID unable to config  
 
  

ThePM
Senior Member
 

Re: RAID imaging problem

Post Posted: Jan 17, 12 20:49

My best device would be to invest some money in some imaging software like ForensicSoft SAFE boot CD. This is absolutely great when dealing with RAID arrays. It is running a write-protected WinPE environment and allows you to add Windows drivers for your RAID controller when it is not detected on boot. Since it is WinPE, you are able to run most of your favourite Windows imager software (Encase, FTK, etc.) to image the RAID array.

Another tool you might want to try out is RAID Reconstructor.

However, it would really help if you were able to boot into the RAID BIOS and check the RAID configuration.  
 

Page 1 of 2
Page 1, 2  Next