hOW TO MAKE RAID IM...
 
Notifications
Clear all

hOW TO MAKE RAID IMAGE

16 Posts
7 Users
0 Likes
3,881 Views
jaclaz
(@jaclaz)
Posts: 5133
Illustrious Member
 

Considering I have a 16Tb one for home use, I would expect larger ones to be quite common for enterprise use. And with 8Tb & 10Tb drives, a 80Tb solution is within SMB limits.

Ok ) , let's take your existing 16 Tb RAID (which I presume to be a Raid 0 out of 4x4 Tb disks or a 1+0 out of 4x8 Tb one).
How would you propose to image it?
Where/how would you store the image(s)?

jaclaz

 
Posted : 29/03/2016 8:23 pm
kacos
(@kacos)
Posts: 93
Trusted Member
 

Ok ) , let's take your existing 16 Tb RAID (which I presume to be a Raid 0 out of 4x4 Tb disks or a 1+0 out of 4x8 Tb one).
How would you propose to image it?
Where/how would you store the image(s)?

Actually it's Raid 5 (usable ~11Tb) 😉
This is exactly why I mentioned it. I think there should be a cost/benefit analysis of the potential evidence, and if it justifies the cost/time needed to image/recreate the entire thing, or document every step and do a live examination.

 
Posted : 29/03/2016 8:29 pm
jaclaz
(@jaclaz)
Posts: 5133
Illustrious Member
 

Actually it's Raid 5 (usable ~11Tb) 😉

How is it configured?
How many disks?
Which size each?

This is exactly why I mentioned it. I think there should be a cost/benefit analysis of the potential evidence, and if it justifies the cost/time needed to image/recreate the entire thing, or document every step and do a live examination.

Well, then it is Off Topic if someone asks "hOW TO MAKE RAID IMAGE".
Let us assume that the OP has the *need* to make an image (which is what was actually asked), and NOT a live examination, how to proceed, then?

jaclaz

 
Posted : 30/03/2016 12:10 am
kacos
(@kacos)
Posts: 93
Trusted Member
 

How is it configured? How many disks? Which size each?

Qnap 4x4Tb Raid5

Well, then it is Off Topic if someone asks "hOW TO MAKE RAID IMAGE".
jaclaz

Since the initial question was not specific "..how to make forensic image of server RAID ,for both combination system and hardware raid..", I don't see how one can answer without considering the size/type of the said RAID. You could write a book and still not cover all the possibilities. So if I was asked I would answer it depends.

Anyway, here are a few articles to get started on RAID/NAS

NAS Forensics Explained by belkasoft
The Impact of RAID on Disk Imaging by NIST
RAID Reassembly - A forensic Challenge

 
Posted : 30/03/2016 1:02 am
jaclaz
(@jaclaz)
Posts: 5133
Illustrious Member
 

How is it configured? How many disks? Which size each?

Qnap 4x4Tb Raid5

Good ) (which in this case means IMHO "bad") 😯 .
As a side-side note, and JFYI there are some theories about RAID 5 being not-so-ideal with such large disk drives, of course it depends on the type/quality of the actual single disks inside the thingy, but just in case
http//www.raid-failure.com/Default.aspx

Anyway, here are a few articles to get started on RAID/NAS

NAS Forensics Explained by belkasoft
The Impact of RAID on Disk Imaging by NIST
RAID Reassembly - A forensic Challenge

Last one being strangely similar to the one I posted initially. wink

jaclaz

 
Posted : 30/03/2016 1:08 pm
kacos
(@kacos)
Posts: 93
Trusted Member
 

Good ) (which in this case means IMHO "bad") 😯 .
As a side-side note, and JFYI there are some theories about RAID 5 being not-so-ideal with such large disk drives, of course it depends on the type/quality of the actual single disks inside the thingy, but just in case
http//www.raid-failure.com/Default.aspx

Well, three years later (since I got it) and with the WD 4Tb Red drives in it, it still rocks. I would prefer to set it up as RAID 6, but I would have lost a lot of valuable space so … cross your fingers that the post in your link is wrong )

Last one being strangely similar to the one I posted initially. wink

Actually it is the same link )

 
Posted : 30/03/2016 2:56 pm
Page 2 / 2
Share: