Using a forensic live distribution (e.x. Helix) it's possible copy bit to bit the logical volume of an hardware raid.
But to verify into the pc bios the correct boot sequence (floppy, cd, ….) it'd be correct to detach the raid to avoid starting pc from logical volume.
Is it right to detach the hd psu to avoid startig pc ? Will the raid controller change the hd status ?
Thanks
If you have hardware based RAID you do not want to boot up the computer with any of the hard drives detached. Prior to getting into the BIOS, the computer will communicate with the RAID card which will notice one or more hard drives missing and set the RAID to be critical or worse, non existant. I have seen this happen more than once with bad results.
If the RAID is managed by a separate card, i.e. it is not built into the motherboard, you can possibly remove the RAID card and then boot the computer.
Keep in mind that removing a hard drive or the RAID card can affect the boot order in the BIOS.
Thanks for answer.
Removing the card controller, is there the possibility that raid configuration will be lost into the controller bios (even if there is a battery) ?
If I'll remove the card w/o effect on the controller bios, and I'll change the order boot into the bios, is the the possibility that attaching again the raid card with HD, the bios could be ignore configured boot order ?
thanks again.
Thanks for answer.
Removing the card controller, is there the possibility that raid configuration will be lost into the controller bios (even if there is a battery) ?
If I'll remove the card w/o effect on the controller bios, and I'll change the order boot into the bios, is the the possibility that attaching again the raid card with HD, the bios could be ignore configured boot order ?
thanks again.
I would say either of those is possible. Depending on the card, sometimes the RAID configuration is stored in the card, sometimes it is stored on the hard drives themselves. If stored on the card, I would think the card would have to be disconnected for a considerable amount of time as a power outage would cause the same loss of power and if a card can't recover from a power outage, that would be a big issue.
As regards to the affect on the boot order when you remove the card and add it, again, that would depend on the computer BIOS.
RAIDs can be daunting to the inexperienced. Like I said, I have seen a couple of situations where someone sent the RAID into a critical situation where it had to rebuild because of an action the person making the image caused.
I have not had a situation wherein I had to remove a hard drive to prevent a computer from booting into the OS. I would suggest putting forensic boot disks in the CD drive(s) and floppy drive(s) and then doing quick research on the key that sends the particular computer you are dealing with into the BIOS.
Another option, especially with hardware RAID cards, is to enter the RAID or SCSI BIOS. The time allowed to press a key to get into one of those areas is often much longer than the time allowed to get into the computer's BIOS. Once into the RAID or SCSI BIOS, you can often just turn the computer off without any damage and then start all over again.
thanks again.