Hi,
I'm after receiving 3 hard disks. I was told the config was 1 x system disk (no RAID) and the two other disks were in a RAID 0 array (basically concatenated into 1 virtual disk). I do not know the stripe size.
In Encase v 6, how to I rebuild the raid so I can read the data that was on the disk?
Thanks,
Fred.
You basically need to add both images into a new EnCase case, go to "Devices", then right-click and choose "Edit Disk Configuration". From there you will have the option to create a RAID.
If you don't know the stripe size, you can either guess by trail and error, or you could try running the "RAID Analyzer" EnScript and check the results.
An automated way which has worked for me on most occasions is
1 Add the 2 x physical disks
2 Under the Entries tab right-click then Scan Disk Configuration
3 Encase will rebuild the RAID and add the logical volume/s under the entries tab.
Dan
