Reading Linux Softw...
 
Notifications
Clear all

Reading Linux Software Raid from image file...help!

3 Posts
3 Users
0 Reactions
391 Views
(@stumpy)
Eminent Member
Joined: 19 years ago
Posts: 23
Topic starter  

I have to examine an external USB device. The unit is unserviceable - I have not been able to fix it. The unit is unbranded with no markings on it (so I can't buy an identical unit to host the hard drives in).

The unit contains two hard drives - both are working. I have imaged both disks. In Linux I have run fdisk -lu against each image. Both disks are reported as having
2 x Linux Raid Autodetect partitions
1 x Linux swap / solaris partition.

mdadm -q states that each disk "is not an md array", however I think that this is because mdadm only works against block devices.

disktype reports that each partition is RAID0 set using 2 regular disks and no spare disks.

However am not convinced that this is correct because one disk is 1TB in size the second disk is 500GB in size. The first partition on each disk is identically sized (54.91 MiB) with both partitions starting and ending at the same sector offsets as each other. The second partition on the first disk is 931.2 GiB, the second partition on the second disk is 465.5 GiB - I don't see how you can stripe the data across two partitions where 1 partition is half the size of the other.

I have found a valid volume boot record for an EXT3 filesystem at the reported partition boundaries on the 1st disk. Guessing that the disks might be mirrored I have attempted to mount these file system unsuccesfully - leading me to conclude that the disks must be striped. Looking at both images in a hex viewer, there is data each disk.

As the first partition on each disk is of identical size, I want to at least try and read the data from that raided partition. I guess that I need to fool mdadm into thinking that my image files are block devices.

Bearing in mind that I can't buy an identical unit to host the disks from the suspect unit…has anyone got any suggestions on how to proceed, please?

TIA!

stumpy


   
Quote
(@stegil)
New Member
Joined: 14 years ago
Posts: 2
 

Hi stumpy,

It was probably from something like the drobo.

You might try to see if it was using Freebsd raid (geom raid0).
A live freebsd cd (freesbie) or you can try Freenas (live cd) and set up the disks.
with freenas, you can add the disks without formating, and just view the disks info to see the raid name so that you can add it correctly.

Cheers
Stegil


   
ReplyQuote
(@rampage)
Reputable Member
Joined: 17 years ago
Posts: 354
 

I have to examine an external USB device. The unit is unserviceable - I have not been able to fix it. The unit is unbranded with no markings on it (so I can't buy an identical unit to host the hard drives in).

The unit contains two hard drives - both are working. I have imaged both disks. In Linux I have run fdisk -lu against each image. Both disks are reported as having
2 x Linux Raid Autodetect partitions
1 x Linux swap / solaris partition.

mdadm -q states that each disk "is not an md array", however I think that this is because mdadm only works against block devices.

disktype reports that each partition is RAID0 set using 2 regular disks and no spare disks.

However am not convinced that this is correct because one disk is 1TB in size the second disk is 500GB in size. The first partition on each disk is identically sized (54.91 MiB) with both partitions starting and ending at the same sector offsets as each other. The second partition on the first disk is 931.2 GiB, the second partition on the second disk is 465.5 GiB - I don't see how you can stripe the data across two partitions where 1 partition is half the size of the other.

I have found a valid volume boot record for an EXT3 filesystem at the reported partition boundaries on the 1st disk. Guessing that the disks might be mirrored I have attempted to mount these file system unsuccesfully - leading me to conclude that the disks must be striped. Looking at both images in a hex viewer, there is data each disk.

As the first partition on each disk is of identical size, I want to at least try and read the data from that raided partition. I guess that I need to fool mdadm into thinking that my image files are block devices.

Bearing in mind that I can't buy an identical unit to host the disks from the suspect unit…has anyone got any suggestions on how to proceed, please?

TIA!

stumpy

mdadm works on partitions and not on raw drives, so if you have 2 partitions of the same size they can be part of a striped raid0 volume.

what you can do is associate each partition to a loop device and try to build the array from the two loops

jm2c


   
ReplyQuote
Share: