Linux Raid Reconstr...
 
Notifications
Clear all

Linux Raid Reconstruction

19 Posts
2 Users
0 Likes
4,961 Views
(@om602)
Posts: 14
Active Member
Topic starter
 

Yes but wouldnt that me the same as xmount? I will use EWFmount

 
Posted : 02/02/2017 3:21 pm
(@om602)
Posts: 14
Active Member
Topic starter
 

That was a really good suggestion
File -s
/dev/loop0 Linux Software RAID version 1.2 (1) UUID=b38bc47dc9973cb92076d40ea8e346c1 name=rescue0 level=1 disks=2
/dev/loop1 Linux Software RAID version 1.2 (1) UUID=38399a30ee8a673ffd1ab5ffe8e71f59 name=rescue1 level=1 disks=2
/dev/loop2 Linux Software RAID version 1.2 (1) UUID=e12051e1 8fcd7a4932e64ba9c6e0494 name=rescue2 level=1 disks=2
/dev/loop3 DOS/MBR boot sector; partition 1 ID=0xfd, start-CHS (0x3ff,254,63), end-CHS (0x3ff,254,63), startsector 2048, 3452983473 sectors, extended partition table (last)

MDADM
root@kali/mnt/ewf# mdadm --examine /dev/loop0 /dev/loop1 /dev/loop2 /dev/loop3
/dev/loop0
Magic a92b4efc
Version 1.2
Feature Map 0x0
Array UUID b38bc47dc9973cb92076d40ea8e346c1
Name rescue0
Creation Time Wed Nov 4 111520 2015
Raid Level raid1
Raid Devices 2

Avail Dev Size 33538049 (15.99 GiB 17.17 GB)
Array Size 16768896 (15.99 GiB 17.17 GB)
Used Dev Size 33537792 (15.99 GiB 17.17 GB)
Data Offset 16384 sectors
Super Offset 8 sectors
Unused Space before=16304 sectors, after=3873472944 sectors
State clean
Device UUID ef99ca1cd3f3936eec80360162077227

Update Time Mon Oct 17 214031 2016
Checksum a9fe195e - correct
Events 45

Device Role Active device 1
Array State AA ('A' == active, '.' == missing, 'R' == replacing)
/dev/loop1
Magic a92b4efc
Version 1.2
Feature Map 0x0
Array UUID 38399a30ee8a673ffd1ab5ffe8e71f59
Name rescue1
Creation Time Wed Nov 4 111523 2015
Raid Level raid1
Raid Devices 2

Avail Dev Size 1048065 (511.75 MiB 536.61 MB)
Array Size 523968 (511.69 MiB 536.54 MB)
Used Dev Size 1047936 (511.69 MiB 536.54 MB)
Data Offset 512 sectors
Super Offset 8 sectors
Unused Space before=432 sectors, after=3872422192 sectors
State clean
Device UUID 65ea1928c8be4890fefbc363f129ae49

Update Time Tue Oct 18 040939 2016
Checksum 1aa6b608 - correct
Events 76

Device Role Active device 1
Array State AA ('A' == active, '.' == missing, 'R' == replacing)
/dev/loop2
Magic a92b4efc
Version 1.2
Feature Map 0x0
Array UUID e12051e108fcd7a4932e64ba9c6e0494
Name rescue2
Creation Time Wed Nov 4 111528 2015
Raid Level raid1
Raid Devices 2

Avail Dev Size 419168257 (199.88 GiB 214.61 GB)
Array Size 209584000 (199.87 GiB 214.61 GB)
Used Dev Size 419168000 (199.87 GiB 214.61 GB)
Data Offset 262144 sectors
Super Offset 8 sectors
Unused Space before=262064 sectors, after=3452989872 sectors
State clean
Device UUID 9cc87a40524004c9930fdc468c68bfad

Update Time Tue Oct 18 040940 2016
Checksum f1835d25 - correct
Events 228

Device Role Active device 1
Array State AA ('A' == active, '.' == missing, 'R' == replacing)
/dev/loop3
MBR Magic aa55
Partition[0] 3452983473 sectors at 2048 (type fd)

 
Posted : 02/02/2017 3:32 pm
(@thefuf)
Posts: 262
Reputable Member
 

/dev/loop3 DOS/MBR boot sector; partition 1 ID=0xfd, start-CHS (0x3ff,254,63), end-CHS (0x3ff,254,63), startsector 2048, 3452983473 sectors, extended partition table (last)

This looks like a partition table within a partition. Can you run "mmls /dev/loop3", if you have TSK installed, and paste the output here?


Edit well, this might be an extended partition, which wasn't recognized by mdadm.

 
Posted : 02/02/2017 3:35 pm
(@om602)
Posts: 14
Active Member
Topic starter
 

root@kali/mnt/ewf# mmls /dev/loop3
DOS Partition Table
Offset Sector 0
Units are in 512-byte sectors

Slot Start End Length Description
000 Meta 0000000000 0000000000 0000000001 Primary Table (#0)
001 ------- 0000000000 0000002047 0000002048 Unallocated
002 000000 0000002048 3452985520 3452983473 Linux RAID (0xfd)
003 ------- 3452985521 3452987567 0000002047 Unallocated

 
Posted : 02/02/2017 3:37 pm
(@thefuf)
Posts: 262
Reputable Member
 

root@kali/mnt/ewf# mmls /dev/loop3
DOS Partition Table
Offset Sector 0
Units are in 512-byte sectors

Slot Start End Length Description
000 Meta 0000000000 0000000000 0000000001 Primary Table (#0)
001 ------- 0000000000 0000002047 0000002048 Unallocated
002 000000 0000002048 3452985520 3452983473 Linux RAID (0xfd)
003 ------- 3452985521 3452987567 0000002047 Unallocated

And "mmls 1.1.dd" (the raw image) also, because it can be an extended partition.

 
Posted : 02/02/2017 3:42 pm
(@om602)
Posts: 14
Active Member
Topic starter
 

root@kali/mnt/ewf# mmls ewf1
DOS Partition Table
Offset Sector 0
Units are in 512-byte sectors

Slot Start End Length Description
000 Meta 0000000000 0000000000 0000000001 Primary Table (#0)
001 ------- 0000000000 0000002047 0000002048 Unallocated
002 000000 0000002048 0033556480 0033554433 Linux RAID (0xfd)
003 ------- 0033556481 0033558527 0000002047 Unallocated
004 000001 0033558528 0034607104 0001048577 Linux RAID (0xfd)
005 ------- 0034607105 0034609151 0000002047 Unallocated
006 000002 0034609152 0454039552 0419430401 Linux RAID (0xfd)
007 ------- 0454039553 0454043647 0000004095 Unallocated
008 Meta 0454041600 3907029167 3452987568 Win95 Extended (0x0f)
009 Meta 0454041600 0454041600 0000000001 Extended Table (#1)
010 001000 0454043648 3907027120 3452983473 Linux RAID (0xfd)
011 ------- 3907027121 3907029167 0000002047 Unallocated

 
Posted : 02/02/2017 3:44 pm
(@thefuf)
Posts: 262
Reputable Member
 

losetup -r -o $((454043648*512)) /dev/loop4 1.1.dd
file -s /dev/loop4
mdadm --examine /dev/loop4

Does it contain a RAID superblock?

If yes, run "mdadm -IR /dev/loop0 /dev/loop1 /dev/loop2 /dev/loop4" to start the arrays.

 
Posted : 02/02/2017 3:48 pm
(@om602)
Posts: 14
Active Member
Topic starter
 

File -s

/dev/loop4 Linux Software RAID version 1.2 (1) UUID=20571a2915919e519e436079b39eba68 name=rescue3 level=1 disks=2


MDADM
oot@kali/mnt/ewf# mdadm --examine /dev/loop4
/dev/loop4
Magic a92b4efc
Version 1.2
Feature Map 0x0
Array UUID 20571a2915919e519e436079b39eba68
Name rescue3
Creation Time Wed Nov 4 111535 2015
Raid Level raid1
Raid Devices 2

Avail Dev Size 3452721329 (1646.39 GiB 1767.79 GB)
Array Size 1726360512 (1646.39 GiB 1767.79 GB)
Used Dev Size 3452721024 (1646.39 GiB 1767.79 GB)
Data Offset 262144 sectors
Super Offset 8 sectors
Unused Space before=262064 sectors, after=2352 sectors
State clean
Device UUID bd4f30d5d04e68cc38da6d3278295bbc

Update Time Tue Oct 18 040939 2016
Checksum 76ad4038 - correct
Events 290

Device Role Active device 1
Array State AA ('A' == active, '.' == missing, 'R' == replacing)

 
Posted : 02/02/2017 4:32 pm
(@om602)
Posts: 14
Active Member
Topic starter
 

I managed to get what I needed
Adjust config-file /etc/mdadm/mdadm.conf
Put DEVICE /dev/loop* in config file

Scan for RAID-sets mdadm –assemble –scan
Run it MDADM –run /dev/md125
Mount /dev/md125 /mnt

Not sure about that extended partition, but I got the DB's from the third one.

 
Posted : 03/02/2017 3:25 pm
Page 2 / 2
Share: