hOW TO MAKE RAID IM...
 
Notifications
Clear all

hOW TO MAKE RAID IMAGE

16 Posts
7 Users
0 Likes
3,880 Views
(@aleks)
Posts: 6
Active Member
Topic starter
 

Can some body to help me step by step how to make forensic image of server RAID ,for both combination system and hardware raid.

 
Posted : 24/03/2016 6:16 am
Igor_Michailov
(@igor_michailov)
Posts: 529
Honorable Member
 

I have used Linen with Network Crossover.

 
Posted : 24/03/2016 11:45 am
(@mobileforensicswales)
Posts: 274
Reputable Member
 

There are a great number of methods that depend on your resources, how much time you have been allocated to the task, whether or not you can turn the server off?

Can you explain further or is this another homework exercise with the backwards caps not even being addresses in the title 😯

 
Posted : 24/03/2016 1:14 pm
(@rapid015)
Posts: 5
Active Member
 

The easiest way to get a viable image of data on a RAID is to boot it in as it stands and do a live acquisition.

There are tools out there to rebuild the RAID if you have taken individual disk images however I have not had success with these.

 
Posted : 29/03/2016 12:55 am
jaclaz
(@jaclaz)
Posts: 5133
Illustrious Member
 

The easiest way to get a viable image of data on a RAID is to boot it in as it stands and do a live acquisition.

But hardly the "best" option.

There are tools out there to rebuild the RAID if you have taken individual disk images however I have not had success with these.

Well, they are tools, and there are a lot of factors in the equation, usually a RAID can be rebuilt fine from single images.

@Aleks
http//pyflag.sourceforge.net/Documentation/articles/raid/reconstruction.html

jaclaz

 
Posted : 29/03/2016 2:11 pm
Igor_Michailov
(@igor_michailov)
Posts: 529
Honorable Member
 

R-Studio (for rebuild) and X-Ways (for hard drives analysis) can do it well.

 
Posted : 29/03/2016 3:40 pm
kacos
(@kacos)
Posts: 93
Trusted Member
 

Don't you think the size of the RAID is a major factor affecting how you'll handle it? If you have a say 80Tb Raid you wouldn't image each disk and rebuild it, would you?

 
Posted : 29/03/2016 4:44 pm
jaclaz
(@jaclaz)
Posts: 5133
Illustrious Member
 

Don't you think the size of the RAID is a major factor affecting how you'll handle it? If you have a say 80Tb Raid you wouldn't image each disk and rebuild it, would you?

Well, let's first have an 80 Tb sized Raid, and later we will talk of the possible issues arising from its examination.

I would guess that thingies like this
http//www.buffalotech.com/products/desktop-hard-drives/drivestation/drivestation-ultra-10-drive
which sell for a mere US$ 9,999.99 😯 are not that much common ? .

However there are solutions based on NOT "consolidating" it (which I believe is what you actually mean by re-building) but rather "virtually" recreating it.
As an example, DMDE
http//dmde.com/
as well as the approach in the previously given link can rebuild a (virtual) RAID filesystem "assembling" separate images or disks.

jaclaz

 
Posted : 29/03/2016 5:29 pm
(@wookieshaver)
Posts: 27
Eminent Member
 

I have used both Paladin and Paladin Edge to image a raid server. (Booting to the Paladin environment from either a usb external DVD drive or usb flash media depending upon responsiveness of the server)

Once booted to Paladin, open the paladin toolbox and click on disk manager, you should be able to see the raid volumes to image.

More information here https://www.sumuri.com/products/paladin/

 
Posted : 29/03/2016 6:48 pm
kacos
(@kacos)
Posts: 93
Trusted Member
 

I would guess that thingies like this
http//www.buffalotech.com/products/desktop-hard-drives/drivestation/drivestation-ultra-10-drive
which sell for a mere US$ 9,999.99 😯 are not that much common ? .

Considering I have a 16Tb one for home use, I would expect larger ones to be quite common for enterprise use. And with 8Tb & 10Tb drives, a 80Tb solution is within SMB limits.

 
Posted : 29/03/2016 8:09 pm
Page 1 / 2
Share: