Acquiring RAID with...
 
Notifications
Clear all

Acquiring RAID with Linen (Helix)

7 Posts
3 Users
0 Reactions
541 Views
SleepParalysis
(@sleepparalysis)
Eminent Member
Joined: 18 years ago
Posts: 42
Topic starter  

Does anyone have any experience acquiring a RAID array with Linen?

I'm wondering if it is possible to make a physical acquisition of the entire array at once and not just each drive independently.


   
Quote
(@fresponse_s)
Trusted Member
Joined: 17 years ago
Posts: 70
 

Sure, linen works off of /dev/xxx devices.. sort of depends on how your raid is setup at that point.

What type of RAID are we talking? Are we talking software RAID "/dev/mdX"?


   
ReplyQuote
SleepParalysis
(@sleepparalysis)
Eminent Member
Joined: 18 years ago
Posts: 42
Topic starter  

Sure, linen works off of /dev/xxx devices.. sort of depends on how your raid is setup at that point.

What type of RAID are we talking? Are we talking software RAID "/dev/mdX"?

Hardware RAID 5, mainly I guess I need to test this in a lab but I've no arrays to preview with Linen. I use Linen in a lot of other acquistions so I'm sure it must be the same exact process.

Thanks for the reply!


   
ReplyQuote
(@fresponse_s)
Trusted Member
Joined: 17 years ago
Posts: 70
 

Should be, just depends on how the drives are configured.

Hardware raid 5.. I'm guessing you'll see a single /dev/XYZ device.

Just have the client send you the dmesg output and you can google for more information on the RAID system and type.

M Shannon


   
ReplyQuote
SleepParalysis
(@sleepparalysis)
Eminent Member
Joined: 18 years ago
Posts: 42
Topic starter  

Should be, just depends on how the drives are configured.

Hardware raid 5.. I'm guessing you'll see a single /dev/XYZ device.

Just have the client send you the dmesg output and you can google for more information on the RAID system and type.

M Shannon

Great idea, thanks for the tips )


   
ReplyQuote
cfprof
(@cfprof)
Trusted Member
Joined: 20 years ago
Posts: 80
 

Hey Matt,

Can F-Response be used to do a physical RAID acquisition? How about logical?

If so, what is needed? Just being on the same domain with admin rights to the server and the ability to open a port?


   
ReplyQuote
(@fresponse_s)
Trusted Member
Joined: 17 years ago
Posts: 70
 

Wow, sorry I missed this one. Let me answer this now, in the future, please PM me directly if your question is urgent.

Short answer. Yes, F-Response can be used to aquire RAID.

Simply put, when F-Response looks at the local drives, it sees the RAID array as one large physical disk (in most instances).

How will you know what F-Response will show you? Simple, open up the MMC Snap-in for Disk Management and look at the physical drives, that's what F-Response will find and present.

Rights? F-Response just needs to be executed on the server and the F-Response port needs to be open and accessible.

But, don't take my word for it, Lance Mueller did just this a few weeks ago.

http//www.forensickb.com/2008/05/f-response-to-rescue.html

As always, PM or Contact some at sales@f-response.com if you have further questions.

Warmest Regards,


   
ReplyQuote
Share: