I recently acquired a RAID5 server running Novell 6.1 (4 drive array - one was a spare it appears). I imaged all 4 SCSI drives individually, and was able to recreate the RAID array in EnCase (6.11).
I see 3 partitions that encase finds automatically. The C partition is FAT16 and no problem there, but the D & E partitions are different. D is in an unknown format, while E is the NETWARE partition. E shows volume slack, a Hot Fix, Volume Boot, & unallocated space. The partition code reports "#65 Novell 31" if that helps.
I'm not that familiar with Novell workings, but is there a way I can see the data inside this Novell partition? I see there is data in the unallocated and volume areas for both D & E, but my client's concern is the E drive in this case.
Please ask me anything you need if I haven't provided enough info for you. Thanks!
Jason
Runtime (http//
I'm not sure if it'll work with image files, but their other software does. I have attached raw NW disks to my Windows workstation and got at them using it.
paul
Jason
One work around would be to load the image files into EnCase but select the option that stops EnCase interpreting the file system. You should then have access to the raw data and can try some carving options to see what that gives you.
It may be enough to give you an appreciation of the content of the drive.
Stu