Imaging Dead System with Hardware Based RAID configured

Are the drives OK? If so image them and use X-Ways or similar and rebuild the array.

thanks bithead,

can you tell me exactly which X-Ways software (name) can do this job for me. Can i rebuild any level of RAID with it? i mean like nested RAID 1+0 or RAID 5+1?

I want to analyze the evidence on FTK 2.0 after taking images. Will it be possible?

800 Euros, ack!

http//www.paraben-forensics.com/catalog/product_info.php?products_id=374

Paraben .. 15 day trial for free. See if their RAID recovery will work for you. 😉

Considering the two disks array i would say it's a raid1 array, it's really rare to find a raid0 on a server, for obvious reasons.
so i would suggest to make a bitstream image of both disks, and see if you can access their content, you should be able to access data on a single disk if it's a raid1 array.
else try using x-ways.

800 Euros, ack!

http//www.paraben-forensics.com/catalog/product_info.php?products_id=374

Paraben .. 15 day trial for free. See if their RAID recovery will work for you. 😉

As I said or similar. As a long time X-Ways user it is my go to software for problems.

Run Time Software also has RAID Reconstructor for $99 with a trial available.

ForensicMania are You unable too see logical partitions on this drives? if the raid was 1 and it is simple mirror the one disk will be exact copy of second one.

thanks everyone for taking your time to answer my question. It was RAID-1 so i was able to access the contents easily. But at the mean while i was wondering that what if i get servers for forensic analysis with Nested RAID levels.

Any reading material, anyone can refer me?

Is there available any specialized hardware + Software forensic tools for forensic analysis of Nested RAID levels?

Raid Reconstructor and X-Ways Forensics only detect RAID 0 and RAID 5 systems only.

nasted raid arrays are a real pain in the…..
you better be able to boot with a live environment and acquire the volume from there.

then what about write blocking restriction???

I am unable to accept that there is no specialized tools for rebuilding or reconstructing all raid levels.

Why can't i accept?