I have a problem dealing with a system set up RAID 5 with 8 hard drives, 320Gb each. Has a hard drive (1st) that has been damaged by a drop and impact and cannot be repaired with the PC3000. 7 hard drives good. I have collected images of these 7 hard drives in E01 format. Here can you help me find a method to get data from 7 hard drives, missing one hard drive with Raid 5 setting? I tried to bring in R-Studio to re-install Raid, x-way forensics but it failed and reported an unknow file system error. Any comments I would like to thank.
My PC3000 version is not the version Raid edition.
If it is a hardware RAID, usually the controller has built-in capabilities/functions to re-build the array, of course you need to replace the bad disk with a new one.
If you need to work with software on the images, I would rather have RAW (dd-like) image, it is possible that the Encase format is part of the problem.
Assumed that the images are good, I believe you can use Arsenal Image Mounter (that in turn uses libewf functions) to mount them as virtual disks:
https://arsenalrecon.com/products/
Otherwise you can try (through the Arsenal Virtual disks or - directly on RAW images or even directly on the "good" disks, since you have the images) DMDE:
that has quite good RAID capabilities:
https://dmde.com/manual/raids.html
jaclaz
If it is a hardware RAID, usually the controller has built-in capabilities/functions to re-build the array, of course you need to replace the bad disk with a new one.
If you need to work with software on the images, I would rather have RAW (dd-like) image, it is possible that the Encase format is part of the problem.
Assumed that the images are good, I believe you can use Arsenal Image Mounter (that in turn uses libewf functions) to mount them as virtual disks:
https://arsenalrecon.com/products/
Otherwise you can try (through the Arsenal Virtual disks or - directly on RAW images or even directly on the "good" disks, since you have the images) DMDE:
that has quite good RAID capabilities:
https://dmde.com/manual/raids.html
jaclaz
the problem is I only have the hard drive on hand. collecting hard drive images in Raw format is not difficult, I can completely use the tools I have available to get Raw images of each hard drive. But still the problem is that if using Arsenal Image Mout can not solve the problem of Raid, because when moun up with the software is currently Unknow file System. I have not tried DEME yet. but to my knowledge DEME will not solve this problem without the image of a damaged hard drive. How to compensate for a missing disk image in R-studio or other software. When I buid Raid with X-way, although it still shows as Unknow File System, but when I run "VFS" in X-Way, there is still data.
If you have 7 RAW images, you can have 7 virtual disks with Arsenal Image Mounter.
Of course they will all be "Unknown File System", but that is completely irrelevant, the File System only exists when the whole RAID exists, the idea of the image mounter is to have the \\PhysicalDrive(s) accessible.
You add to the RAID within DMDE the 7 images (disks) you have, then you add a NULL disk, set the (right - there may the need to try several different ones) RAID parameters, and only then a File System might become visible/accessible.
The Null disk in DMDE is exactly there to this scope:
https://dmde.com/manual/raids.html
Null disk: used instead of absent or damaged disk
As said Arsenal Image Mounter can also use .e01 images, but it is possible that this intermediate layer is an obstacle, dmde can access the raw images directly, without creating OS-wide virtual disks.
Will it work (in your specific case)?
No way to know in advance.
I am perplexed by your reply, however:
How to compensate for a missing disk image in R-studio or other software.
As I see it, you tried methods A and B and failed, asking for suggestions.
You were suggested to try using method C, instead, and see what happens.
Now you are seemingly asking a different question, how to modify methods A and B so that they work?
jaclaz
If you have 7 RAW images, you can have 7 virtual disks with Arsenal Image Mounter.
Of course they will all be "Unknown File System", but that is completely irrelevant, the File System only exists when the whole RAID exists, the idea of the image mounter is to have the \\PhysicalDrive(s) accessible.
You add to the RAID within DMDE the 7 images (disks) you have, then you add a NULL disk, set the (right - there may the need to try several different ones) RAID parameters, and only then a File System might become visible/accessible.
The Null disk in DMDE is exactly there to this scope:
https://dmde.com/manual/raids.html
Null disk: used instead of absent or damaged disk
As said Arsenal Image Mounter can also use .e01 images, but it is possible that this intermediate layer is an obstacle, dmde can access the raw images directly, without creating OS-wide virtual disks.
Will it work (in your specific case)?
No way to know in advance.
I am perplexed by your reply, however:
How to compensate for a missing disk image in R-studio or other software.
As I see it, you tried methods A and B and failed, asking for suggestions.
You were suggested to try using method C, instead, and see what happens.
Now you are seemingly asking a different question, how to modify methods A and B so that they work?
jaclaz
Agree, I tried your way out but with no success. I have a full disk order of 1 through 8 because I have marked the locations of these disks. As in DEME, the Null Disk takes first place.
Yep, but it may well depend on the parameters you used.
You have set Raid 5 with forward parity with a stripe size of 64 kb and a delay of 1, unless you are sure-sure that these parameters are accurate, i.e. you have the actual settings used in the original array, it is usually the most difficult part to find/get right these parameters.
I.e. it is possible that some of your parameters are wrong (and this affects also the R-Studio and X-Ways approach).
Knowing the file system used on the array and the specific OS under which it was created may (or may not) help in finding out stripe size and rotation, but it is complex.
Basically on one of the disks there must be a copy of the MBR.
The position of it (and the disk number where it is found) may help in determine the stripe size and the rotation, then the bootsector of the partition(s) may be found, and with the data in it, some other known metadata (such as - in the case of a NTFS - the $MFT, the $MFTmirr, may be found, and from the data in the $MFT some other "known" file system files, etc.)
jaclaz
If you have 7 RAW images, you can have 7 virtual disks with Arsenal Image Mounter.
Of course they will all be "Unknown File System", but that is completely irrelevant, the File System only exists when the whole RAID exists, the idea of the image mounter is to have the \\PhysicalDrive(s) accessible.
You add to the RAID within DMDE the 7 images (disks) you have, then you add a NULL disk, set the (right - there may the need to try several different ones) RAID parameters, and only then a File System might become visible/accessible.
The Null disk in DMDE is exactly there to this scope:
https://dmde.com/manual/raids.html
Null disk: used instead of absent or damaged disk
As said Arsenal Image Mounter can also use .e01 images, but it is possible that this intermediate layer is an obstacle, dmde can access the raw images directly, without creating OS-wide virtual disks.
Will it work (in your specific case)?
No way to know in advance.
I am perplexed by your reply, however:
How to compensate for a missing disk image in R-studio or other software.
As I see it, you tried methods A and B and failed, asking for suggestions.
You were suggested to try using method C, instead, and see what happens.
Now you are seemingly asking a different question, how to modify methods A and B so that they work?
jaclaz
Agree, I tried your way out but with no success. I have a full disk order of 1 through 8 because I have marked the locations of these disks. As in DEME, the Null Disk takes first place.
As for software solutions for RAID, I would recommend using Reclaime Pro and UFS Explorer.
Our engineers liked them the most while implementing RAID autodetection in Atola TaskForce.
Sorry, I only have Atola insight forensics. so sad
Sorry, I only have Atola insight forensics. so sad
That doesn't matter, Reclaime Pro may be able to autodetect the RAID settings, that then you can try using with other programs.
Never used it personally, but it does have a good reputation AFAIK:
http://www.reclaime-pro.com/Default.aspx
and you can still try it for 14 days
Or you can try the free version:
http://www.freeraidrecovery.com/?s=rd
jaclaz
Sorry, I only have Atola insight forensics. so sad
That doesn't matter, Reclaime Pro may be able to autodetect the RAID settings, that then you can try using with other programs.
Never used it personally, but it does have a good reputation AFAIK:
http://www.reclaime-pro.com/Default.aspx
and you can still try it for 14 days
Or you can try the free version:
http://www.freeraidrecovery.com/?s=rd
jaclaz
Knowing what I know, the free version of ReclaiMe Pro is not so capable as the paid one.
But the software is worth spending money, a good one for any kind of data recovery not only RAID.