I have a problem de...
 
Notifications
Clear all

I have a problem dealing with a system set up RAID 5 with 8 hard drives, hard driver 1st Damaged

divogame
(@divogame)
New Member

I have a problem dealing with a system set up RAID 5 with 8 hard drives, 320Gb each.  Has a hard drive (1st) that has been damaged by a drop and impact and cannot be repaired with the PC3000.  7 hard drives good.  I have collected images of these 7 hard drives in E01 format.  Here can you help me find a method to get data from 7 hard drives, missing one hard drive with Raid 5 setting?  I tried to bring in R-Studio to re-install Raid, x-way forensics but it failed and reported an unknow file system error.  Any comments I would like to thank.

My PC3000 version is not the version Raid edition. 

Quote
Topic starter Posted : 20/04/2021 11:59 am
jaclaz
(@jaclaz)
Community Legend

If it is a hardware RAID, usually the controller has built-in capabilities/functions to re-build the array, of course you need to replace the bad disk with a new one.

If you need to work with software on the images, I would rather have RAW (dd-like) image, it is possible that the Encase format is part of the problem.

Assumed that the images are good, I believe you can use Arsenal Image Mounter (that in turn uses libewf functions) to mount them as virtual disks:

https://arsenalrecon.com/products/

Otherwise you can try (through the Arsenal Virtual disks or - directly on RAW images or even directly on the "good" disks, since you have the images) DMDE:

https://dmde.com/

that has quite good RAID capabilities:

https://dmde.com/manual/raids.html

jaclaz

 

ReplyQuote
Posted : 20/04/2021 1:24 pm
divogame
(@divogame)
New Member
Posted by: @jaclaz

If it is a hardware RAID, usually the controller has built-in capabilities/functions to re-build the array, of course you need to replace the bad disk with a new one.

If you need to work with software on the images, I would rather have RAW (dd-like) image, it is possible that the Encase format is part of the problem.

Assumed that the images are good, I believe you can use Arsenal Image Mounter (that in turn uses libewf functions) to mount them as virtual disks:

https://arsenalrecon.com/products/

Otherwise you can try (through the Arsenal Virtual disks or - directly on RAW images or even directly on the "good" disks, since you have the images) DMDE:

https://dmde.com/

that has quite good RAID capabilities:

https://dmde.com/manual/raids.html

jaclaz

 

the problem is I only have the hard drive on hand. collecting hard drive images in Raw format is not difficult, I can completely use the tools I have available to get Raw images of each hard drive. But still the problem is that if using Arsenal Image Mout can not solve the problem of Raid, because when moun up with the software is currently Unknow file System. I have not tried DEME yet. but to my knowledge DEME will not solve this problem without the image of a damaged hard drive. How to compensate for a missing disk image in R-studio or other software. When I buid Raid with X-way, although it still shows as Unknow File System, but when I run "VFS" in X-Way, there is still data.

ReplyQuote
Topic starter Posted : 20/04/2021 1:56 pm
jaclaz
(@jaclaz)
Community Legend

If you have 7 RAW images, you can have 7 virtual disks with Arsenal Image Mounter.

Of course they will all be "Unknown File System", but that is completely irrelevant, the File System only exists when the whole RAID exists, the idea of the image mounter is to have the \\PhysicalDrive(s) accessible.

You add to the RAID within DMDE the 7 images (disks) you have, then you add a NULL disk, set the (right - there may the need to try several different ones) RAID parameters, and only then a File System might become visible/accessible. 

The Null disk in DMDE is exactly there to this scope:

https://dmde.com/manual/raids.html

Null disk: used instead of absent or damaged disk

As said Arsenal Image Mounter can also use .e01 images, but it is possible that this intermediate layer is an obstacle, dmde can access the raw images directly, without creating OS-wide virtual disks.

Will it work (in your specific case)?

No way to know in advance.

 

I am perplexed by your reply, however:

How to compensate for a missing disk image in R-studio or other software.

As I see it, you tried methods A and B and failed, asking for suggestions.

You were suggested to try using method C, instead, and see what happens.

Now you are seemingly asking a different question, how to modify methods A and B so that they work?

jaclaz

ReplyQuote
Posted : 20/04/2021 2:43 pm
divogame
(@divogame)
New Member
Posted by: @jaclaz

If you have 7 RAW images, you can have 7 virtual disks with Arsenal Image Mounter.

Of course they will all be "Unknown File System", but that is completely irrelevant, the File System only exists when the whole RAID exists, the idea of the image mounter is to have the \\PhysicalDrive(s) accessible.

You add to the RAID within DMDE the 7 images (disks) you have, then you add a NULL disk, set the (right - there may the need to try several different ones) RAID parameters, and only then a File System might become visible/accessible. 

The Null disk in DMDE is exactly there to this scope:

https://dmde.com/manual/raids.html

Null disk: used instead of absent or damaged disk

As said Arsenal Image Mounter can also use .e01 images, but it is possible that this intermediate layer is an obstacle, dmde can access the raw images directly, without creating OS-wide virtual disks.

Will it work (in your specific case)?

No way to know in advance.

 

I am perplexed by your reply, however:

How to compensate for a missing disk image in R-studio or other software.

As I see it, you tried methods A and B and failed, asking for suggestions.

You were suggested to try using method C, instead, and see what happens.

Now you are seemingly asking a different question, how to modify methods A and B so that they work?

jaclaz

Agree, I tried your way out but with no success. I have a full disk order of 1 through 8 because I have marked the locations of these disks. As in DEME, the Null Disk takes first place.

https://imgur.com/a/6dMmU0m

This post was modified 5 months ago by divogame
ReplyQuote
Topic starter Posted : 20/04/2021 3:00 pm
jaclaz
(@jaclaz)
Community Legend

Yep, but it may well depend on the parameters you used.

You have set Raid 5 with forward parity with a stripe size of 64 kb and a delay of 1, unless you are sure-sure that these parameters are accurate, i.e. you have the actual settings used in the original array, it is usually the most difficult part to find/get right these parameters.

I.e. it is possible that some of your parameters are wrong (and this affects also the R-Studio and X-Ways approach).

Knowing the file system used on the array and the specific OS under which it was created may (or may not) help in finding out stripe size and rotation, but it is complex.

Basically on one of the disks there must be a copy of the MBR.

The position of it (and the disk number where it is found) may help in determine the stripe size and the rotation, then the bootsector of the partition(s) may be found, and with the data in it, some other known metadata (such as - in the case of a NTFS - the $MFT, the $MFTmirr, may be found, and from the data in the $MFT some other "known" file system files, etc.) 

jaclaz

ReplyQuote
Posted : 20/04/2021 6:20 pm
mokosiy
(@mokosiy)
Junior Member
Posted by: @divogame
Posted by: @jaclaz

If you have 7 RAW images, you can have 7 virtual disks with Arsenal Image Mounter.

Of course they will all be "Unknown File System", but that is completely irrelevant, the File System only exists when the whole RAID exists, the idea of the image mounter is to have the \\PhysicalDrive(s) accessible.

You add to the RAID within DMDE the 7 images (disks) you have, then you add a NULL disk, set the (right - there may the need to try several different ones) RAID parameters, and only then a File System might become visible/accessible. 

The Null disk in DMDE is exactly there to this scope:

https://dmde.com/manual/raids.html

Null disk: used instead of absent or damaged disk

As said Arsenal Image Mounter can also use .e01 images, but it is possible that this intermediate layer is an obstacle, dmde can access the raw images directly, without creating OS-wide virtual disks.

Will it work (in your specific case)?

No way to know in advance.

 

I am perplexed by your reply, however:

How to compensate for a missing disk image in R-studio or other software.

As I see it, you tried methods A and B and failed, asking for suggestions.

You were suggested to try using method C, instead, and see what happens.

Now you are seemingly asking a different question, how to modify methods A and B so that they work?

jaclaz

Agree, I tried your way out but with no success. I have a full disk order of 1 through 8 because I have marked the locations of these disks. As in DEME, the Null Disk takes first place.

https://imgur.com/a/6dMmU0m

As for software solutions for RAID, I would recommend using Reclaime Pro and UFS Explorer.

Our engineers liked them the most while implementing RAID autodetection in Atola TaskForce.

 

ReplyQuote
Posted : 22/04/2021 7:58 am
divogame
(@divogame)
New Member

Sorry, I only have Atola insight forensics. so sad

ReplyQuote
Topic starter Posted : 22/04/2021 8:09 am
jaclaz
(@jaclaz)
Community Legend
Posted by: @divogame

Sorry, I only have Atola insight forensics. so sad

That doesn't matter, Reclaime Pro may be able to autodetect the RAID settings, that then you can try using with other programs.

Never used it personally, but it does have a good reputation AFAIK:

http://www.reclaime-pro.com/Default.aspx

and you can still try it for 14 days

Or you can try the free version:

http://www.freeraidrecovery.com/?s=rd

jaclaz

 

 

ReplyQuote
Posted : 22/04/2021 11:33 am
mokosiy
(@mokosiy)
Junior Member
Posted by: @jaclaz
Posted by: @divogame

Sorry, I only have Atola insight forensics. so sad

That doesn't matter, Reclaime Pro may be able to autodetect the RAID settings, that then you can try using with other programs.

Never used it personally, but it does have a good reputation AFAIK:

http://www.reclaime-pro.com/Default.aspx

and you can still try it for 14 days

Or you can try the free version:

http://www.freeraidrecovery.com/?s=rd

jaclaz

 

 

@divogame

Knowing what I know, the free version of ReclaiMe Pro is not so capable as the paid one.

But the software is worth spending money, a good one for any kind of data recovery not only RAID.

ReplyQuote
Posted : 23/04/2021 7:08 am
jahearne
(@jahearne)
Junior Member

I worked a DriveSavers Data Recovery for over a decade and the best luck we had in setting up corrupted RAIDs with software is using UFS Explorer

https://www.ufsexplorer.com/ufs-explorer-raid-recovery.php

 

ReplyQuote
Posted : 05/05/2021 1:27 am
Gsibat
(@gsibat)
New Member

If you have EnCase, the images you have of each member disk can be added.  There is an EnScript that with read the disk images to compile a list of the possible permutations that may work.  Its then a case of trying each permutation until the right one is found, it takes some of the guess work out of the situation.  In respect of the disk that was damaged, EnCase will create a phantom disk, based upon the parity information of the other member disks.

ReplyQuote
Posted : 07/05/2021 6:46 pm
Share: