hOW TO MAKE RAID IM...
 
Notifications
Clear all

hOW TO MAKE RAID IMAGE

16 Posts
7 Users
0 Reactions
6,072 Views
(@aleks)
Active Member
Joined: 9 years ago
Posts: 6
Topic starter  

Can some body to help me step by step how to make forensic image of server RAID ,for both combination system and hardware raid.


   
Quote
Igor_Michailov
(@igor_michailov)
Honorable Member
Joined: 20 years ago
Posts: 529
 

I have used Linen with Network Crossover.


   
ReplyQuote
(@mobileforensicswales)
Reputable Member
Joined: 17 years ago
Posts: 274
 

There are a great number of methods that depend on your resources, how much time you have been allocated to the task, whether or not you can turn the server off?

Can you explain further or is this another homework exercise with the backwards caps not even being addresses in the title 😯


   
ReplyQuote
(@rapid015)
Active Member
Joined: 11 years ago
Posts: 5
 

The easiest way to get a viable image of data on a RAID is to boot it in as it stands and do a live acquisition.

There are tools out there to rebuild the RAID if you have taken individual disk images however I have not had success with these.


   
ReplyQuote
jaclaz
(@jaclaz)
Illustrious Member
Joined: 18 years ago
Posts: 5133
 

The easiest way to get a viable image of data on a RAID is to boot it in as it stands and do a live acquisition.

But hardly the "best" option.

There are tools out there to rebuild the RAID if you have taken individual disk images however I have not had success with these.

Well, they are tools, and there are a lot of factors in the equation, usually a RAID can be rebuilt fine from single images.

@Aleks
http//pyflag.sourceforge.net/Documentation/articles/raid/reconstruction.html

jaclaz


   
ReplyQuote
Igor_Michailov
(@igor_michailov)
Honorable Member
Joined: 20 years ago
Posts: 529
 

R-Studio (for rebuild) and X-Ways (for hard drives analysis) can do it well.


   
ReplyQuote
kacos
(@kacos)
Trusted Member
Joined: 10 years ago
Posts: 93
 

Don't you think the size of the RAID is a major factor affecting how you'll handle it? If you have a say 80Tb Raid you wouldn't image each disk and rebuild it, would you?


   
ReplyQuote
jaclaz
(@jaclaz)
Illustrious Member
Joined: 18 years ago
Posts: 5133
 

Don't you think the size of the RAID is a major factor affecting how you'll handle it? If you have a say 80Tb Raid you wouldn't image each disk and rebuild it, would you?

Well, let's first have an 80 Tb sized Raid, and later we will talk of the possible issues arising from its examination.

I would guess that thingies like this
http//www.buffalotech.com/products/desktop-hard-drives/drivestation/drivestation-ultra-10-drive
which sell for a mere US$ 9,999.99 😯 are not that much common ? .

However there are solutions based on NOT "consolidating" it (which I believe is what you actually mean by re-building) but rather "virtually" recreating it.
As an example, DMDE
http//dmde.com/
as well as the approach in the previously given link can rebuild a (virtual) RAID filesystem "assembling" separate images or disks.

jaclaz


   
ReplyQuote
(@wookieshaver)
Eminent Member
Joined: 14 years ago
Posts: 27
 

I have used both Paladin and Paladin Edge to image a raid server. (Booting to the Paladin environment from either a usb external DVD drive or usb flash media depending upon responsiveness of the server)

Once booted to Paladin, open the paladin toolbox and click on disk manager, you should be able to see the raid volumes to image.

More information here https://www.sumuri.com/products/paladin/


   
ReplyQuote
kacos
(@kacos)
Trusted Member
Joined: 10 years ago
Posts: 93
 

I would guess that thingies like this
http//www.buffalotech.com/products/desktop-hard-drives/drivestation/drivestation-ultra-10-drive
which sell for a mere US$ 9,999.99 😯 are not that much common ? .

Considering I have a 16Tb one for home use, I would expect larger ones to be quite common for enterprise use. And with 8Tb & 10Tb drives, a 80Tb solution is within SMB limits.


   
ReplyQuote
Page 1 / 2
Share: