Hi all,
I've been tasked with acquiring the logical partitions of a RAID 1+0 array.
The controller is an HP 6i array and the drives are SAS.
I cant grab the images straight off the the drives as I dont have a SAS controller or adapter. I was going to boot from a CD and copy the images off that way, but I've read that Linen doesnt like HP Smart arrays.
Would I be better off with helix?
Any guidance appreciated.
Joe
You should check the SAFE Boot Disk from ForensicSoft. It's a boot CD based on WinPE that does a software lock on all the drives/volumes in the computer.
The great part about SAFE is that since it's Windows based, you can dynamically add device drivers without rebooting to be able to access RAID arrays or any other type of storage device that has Windows drivers.
Another key point is that you can use common Windows tools to image the drives, such as Encase 6 or FTK Imager.
With that, you could boot the suspect computer/server with SAFE and use an external USB/Firewire drive as destination drive for your image. If needed, you can add the drivers for your 6i array.
I've used this a couple of time already and it works really well.
is there a free alternative to this? I think I have to do this on saturday and havent got time to raise budget for $400
Linux live disks are a hit and miss affair, so you need to have a few of them in your toolbox. I use one tool based on Debian/Knoppix and a second based on Ubuntu. That gives me a wider variety of driver support. Try out Raptor from Forward Discovery. It's free so if it doesn't help, it's no loss.
Obviously, it's better to be prepared for this next time.