Reconstructing Exte...
 
Notifications
Clear all

Reconstructing External HD(RAID 0)in Encase.

8 Posts
5 Users
0 Likes
1,503 Views
(@tsweet)
Posts: 7
Active Member
Topic starter
 

I have 2 500gb drives with a RAID 0 configuration. These where a part of an external HD unit in which the power supply has failed. I took the drives out and imaged them with encase.

Within encase now I have 2 drives with no folder structure, which I expect since encase doesn't know the raid configuration. So my question is, how should I go about getting this data to be readable within encase?

I was under the impression I needed to right click the drive and select "Scan disk configuration" But these seems to do nothing in this case.

Any advice would be greatly appreciated.
Thank you.

 
Posted : 18/10/2010 8:07 pm
(@mscotgrove)
Posts: 938
Prominent Member
 

I do not know how to do it in Encase, but I hope the following is useful.

If the disks are just NTFS then it is likely that all of the disk are in RAID-0, and so all you need to do is work out the disk sequence, and the stripe size. Working by hand, the best way to work out the stripe size is by looking at the $MFT as they are largely sequential entries.

If the disk is a NAS / Unix based one then the start of the disk may be in RAID-1 until the data section is found. You therefore need to to determine the length of the RAID-1, then the striping of the RAID-0, along with the sequence.

Typical stripe sizes are 64 or 128 sectors, but the range can go from 8 sectors to maybe 2048 sector.

 
Posted : 18/10/2010 9:17 pm
(@jdunn)
Posts: 4
New Member
 

Once you add both drives to the case file do the following

Click on devices -> right click, 'edit disk configuration' -> select 'stripe' -> input the stripe size -> hit 'insert' key on your keyboard -> add your first physical image and click 'ok' -> hit 'insert' key again and add your second physical image -> click 'ok'.

Assuming you performed the process correctly, go back to the entries tab. You should now have one physical disk showing up with a readable file system. If the information appears jumbled, you may have entered the wrong stripe size.

If you want to ensure the correct stripe size, you can download RAID reconstructor here http//www.runtime.org/raid.htm

 
Posted : 19/10/2010 5:46 am
(@marius)
Posts: 8
Active Member
 

I typically use Winhex to reconstruct RAID systems. These external units could be RAID 0 or could be JBOD's. jdunn's advice to use RAID reconstructor might work, but you will struggle if it is ext3fs or similar. If you don't come right, let me know, I will help you rebuild the data structures.

Marius
MVI Data Recovery

 
Posted : 19/10/2010 3:51 pm
(@tsweet)
Posts: 7
Active Member
Topic starter
 

Thanks for all the help so far, I have yet to successfully reconstruct the RAID but here is what I have done

I followed Jdunn's instructions using a variety of stripe sizes, none of which displayed anything but unused disk space.

I then connected the drives to my system and ran RAID re-constructor, it gave several 'failed to read from sector' errors and thus was unsuccessful.

I'm sure it's obvious I have not had to deal with a RAID prior to this and as such I am out of ideas. ?

 
Posted : 19/10/2010 8:59 pm
(@marius)
Posts: 8
Active Member
 

Tsweet, "I then connected the drives to my system and ran RAID re-constructor, it gave several 'failed to read from sector' errors and thus was unsuccessful."

You have hard drive problems and will need to get a data recovery company to sort for you. Where are you based, I could recommend a few companies.

Marius
MVI Data Recovery

 
Posted : 19/10/2010 9:25 pm
(@tsweet)
Posts: 7
Active Member
Topic starter
 

I'm in New Hampshire.
I guess what confused me about this was that I got no errors in encase during acquisition.

 
Posted : 20/10/2010 12:44 am
(@apfelkraft-ch)
Posts: 15
Active Member
 

All clear now…. D

 
Posted : 01/06/2011 3:05 am
Share: