Notifications
Clear all

RAID Question

11 Posts
9 Users
0 Reactions
1,148 Views
wsharp
(@wsharp)
Active Member
Joined: 18 years ago
Posts: 6
Topic starter  

I have a RAID, probably 5, that was taken out of the box by someone. They do not remember the order of the drives. The drives were taken out and provided to a third party without the server. The server was recovered later.
I know all things are possible, but can the RAID be rebuilt without loss of data?


   
Quote
Mark_Eskridge
(@mark_eskridge)
Trusted Member
Joined: 16 years ago
Posts: 50
 

Look into "RAID reconstructor"

http //w w w.runtime. org / raid. htm

If you just put the drives back into the box, in a random order not recognized as the original configuration, the software/hardware will want to build a new RAID and you will lose access to all of the original data.


   
ReplyQuote
(@patrick4n6)
Honorable Member
Joined: 16 years ago
Posts: 650
 

If you want free, look into PyFLAG which was created by Aust DoD. I watched them demo it over 5 years ago and it was impressive at RAID reconstruction even back then.

X-Ways is great at reconstructing RAIDs, but is not free.


   
ReplyQuote
wsharp
(@wsharp)
Active Member
Joined: 18 years ago
Posts: 6
Topic starter  

That is what I have also been told/read as well. An individual is going to testify that putting the drives back into the raid in random order will not destroy the data. I can't find any reference anywhere this is viable.


   
ReplyQuote
CFP001
(@cfp001)
Eminent Member
Joined: 16 years ago
Posts: 36
 

I am looking for a reference/standard. While it doesn't say "why", this presentation says what most anyone would tell, don't mess up the order. http//www.thetrainingco.com/pdf/Wednesday/RAID%20Rebuilding%20-%20Dickerman.pdf

Raid Reconstructor is the cheapest and easiest way I can think of to do this right now. I'm sure you could figure it out (striping and parity) with community tools (TSK, WINHEX) but I'm not smart enough yet to tell you how to do that and raid reconstrutor is pretty cheap.

Image the drives first and make a backup to work with and you have much less risk and can try (aka learn) with less worry.


   
ReplyQuote
wsharp
(@wsharp)
Active Member
Joined: 18 years ago
Posts: 6
Topic starter  

Unfortunately it was scrambled before I got it. I think they played the shell game and came up goose eggs.


   
ReplyQuote
(@gkelley)
Estimable Member
Joined: 21 years ago
Posts: 128
 

Depending on the type of RAID (RAID type, controller, hardware/software) it is, it is possible that putting the drives in random order will cause the RAID controller to reinitialize. It is also possible that the controller will interpret the drives correctly and put them back. It is also possible the controller will do nothing other than provide an error.


   
ReplyQuote
(@douglasbrush)
Prominent Member
Joined: 16 years ago
Posts: 812
 

Also with RR

Trial Limitation You will be able to determine if RAID Reconstructor can reconstruct your array before you need to purchase a license. The demo version does not allow for any type of output.

So you can try before you buy. Have you imaged all the drives - working from images or the physical disks?


   
ReplyQuote
(@angrybadger)
Estimable Member
Joined: 18 years ago
Posts: 164
 

That is what I have also been told/read as well. An individual is going to testify that putting the drives back into the raid in random order will not destroy the data. I can't find any reference anywhere this is viable.

Its easy enough to 'almost' get a RAID stripe pattern correct.

The almost state can sometimes mean that the computer will be able to find and fire up the ntloader and start mounting the volume with what it believes is a valid MFT.
at this point you get a manure/air con interface situation where the NT attempts to fix the MFT.


   
ReplyQuote
 AvRM
(@avrm)
Active Member
Joined: 15 years ago
Posts: 14
 

Your question can't be answered with a black or white answer since there are to many variables. You said that a witness is going to testify, stating that putting the drives in a incorrect order will force the Raid to rebuild.
This is possible but it depends on the controller. If you want to be certain and confident on this one, you need to find out the type of raid controller brand, model and firmware. Some of the newer smart raid arrays have the ability to locate the drive based on the header and initialize the raid properly even if the drive order has been mixed. Therefore knowing the controller type and firmware are key. As for Raid Reconstructor, I personally have little faith in it based on my own experience. It may be able to rebuild the raid for you if your lucky, but it depends on the type of Raid and the parity type. We rebuild about 95% off all Raid arrays that we receive for recovery purposes manually with a hex editor.

Good luck!


   
ReplyQuote
Page 1 / 2
Share: