I am dealing with a server that has an OS Raid and Data Storage Raid (24-32TB - still waiting on client to confirm). For the purpose of this project, I only need to a logical image of the storage raid, but I don't want to deal with recompiling the raid or being locked down to tools that can support the images of single drives (to reconstruct the RAID).
With that said, I was thinking about doing a live image of the data storage partition using FTK Imager Lite. This would give me a single DD image (yes, a very large dd image) of the storage array.
Has anyone ever done a live image this large before? Has anyone run into any complications when imaging a large data source with FTK Imager Lite (such as memory issues, etc.)?
Thanks for the info. Much appreciated.
honestly i've never tried acquiring such a large image, but i don't think that would be the problem.
the problem would be examining it later on.
are you sure you really need a dd of the partition/logical volume?
before attempting such a huge task, plan it carefully and evaluate if there really is the need, or if you can pursue alternative ways, which might exist depending on what's your final objective.
With that said, I was thinking about doing a live image of the data storage partition using FTK Imager Lite. This would give me a single DD image (yes, a very large dd image) of the storage array.
I assume you have evaluated the possibility of not imaging the entire partition.
Will the partition change as you image it, that is, is the data storage functionality 'live' also? If it is, you risk getting an inconsistencies between the early part of the image and the late part. You may need to consider that as a possible source of ambiguity. Of course, if the file system allows you to do snapshot (as in ZFS; Shadow Copy in Windows), use it if you can. (But make sure you know how it works, and how it affects the storage first.)
You better also plan for failure and recovery – expect at least two failures during the imaging. That is, plan for having to resume from at least two failures. And don't image without having talked it through with whoever 'owns' the storage solution. You're going to stress the disks, and if there is a HDD failure … everyone involved needs to be ready for it. It might work fine, but if the RAID isn't entirely sound, you may get a RAID failure. What happens then? Will the RAID screech to a full stop, or will it continue to operate in degraded mode? Will you be allowed to continue imaging in degraded mode, or will the RAID need to be resilvered first?
Do a risk inventory what unwanted events are lurking in this particular task, how will they affect your job, and how do you need to meet them if they should occur? Murphy's law is the only thing that should never be assumed to fail.
Is the server running in a virualised environment? What about obtaining a VHD snaphot instead of a logical acquisition.