Reconstructing Exte...
 
Notifications
Clear all

Reconstructing External HD(RAID 0)in Encase.

tsweet
(@tsweet)
New Member

I have 2 500gb drives with a RAID 0 configuration. These where a part of an external HD unit in which the power supply has failed. I took the drives out and imaged them with encase.

Within encase now I have 2 drives with no folder structure, which I expect since encase doesn't know the raid configuration. So my question is, how should I go about getting this data to be readable within encase?

I was under the impression I needed to right click the drive and select "Scan disk configuration" But these seems to do nothing in this case.

Any advice would be greatly appreciated.
Thank you.

Quote
Topic starter Posted : 18/10/2010 9:07 pm
mscotgrove
(@mscotgrove)
Senior Member

I do not know how to do it in Encase, but I hope the following is useful.

If the disks are just NTFS then it is likely that all of the disk are in RAID-0, and so all you need to do is work out the disk sequence, and the stripe size. Working by hand, the best way to work out the stripe size is by looking at the $MFT as they are largely sequential entries.

If the disk is a NAS / Unix based one then the start of the disk may be in RAID-1 until the data section is found. You therefore need to to determine the length of the RAID-1, then the striping of the RAID-0, along with the sequence.

Typical stripe sizes are 64 or 128 sectors, but the range can go from 8 sectors to maybe 2048 sector.

ReplyQuote
Posted : 18/10/2010 10:17 pm
jdunn
(@jdunn)
New Member

Once you add both drives to the case file do the following

Click on devices -> right click, 'edit disk configuration' -> select 'stripe' -> input the stripe size -> hit 'insert' key on your keyboard -> add your first physical image and click 'ok' -> hit 'insert' key again and add your second physical image -> click 'ok'.

Assuming you performed the process correctly, go back to the entries tab. You should now have one physical disk showing up with a readable file system. If the information appears jumbled, you may have entered the wrong stripe size.

If you want to ensure the correct stripe size, you can download RAID reconstructor here http//www.runtime.org/raid.htm

ReplyQuote
Posted : 19/10/2010 6:46 am
marius
(@marius)
New Member

I typically use Winhex to reconstruct RAID systems. These external units could be RAID 0 or could be JBOD's. jdunn's advice to use RAID reconstructor might work, but you will struggle if it is ext3fs or similar. If you don't come right, let me know, I will help you rebuild the data structures.

Marius
MVI Data Recovery

ReplyQuote
Posted : 19/10/2010 4:51 pm
tsweet
(@tsweet)
New Member

Thanks for all the help so far, I have yet to successfully reconstruct the RAID but here is what I have done

I followed Jdunn's instructions using a variety of stripe sizes, none of which displayed anything but unused disk space.

I then connected the drives to my system and ran RAID re-constructor, it gave several 'failed to read from sector' errors and thus was unsuccessful.

I'm sure it's obvious I have not had to deal with a RAID prior to this and as such I am out of ideas. ?

ReplyQuote
Topic starter Posted : 19/10/2010 9:59 pm
marius
(@marius)
New Member

Tsweet, "I then connected the drives to my system and ran RAID re-constructor, it gave several 'failed to read from sector' errors and thus was unsuccessful."

You have hard drive problems and will need to get a data recovery company to sort for you. Where are you based, I could recommend a few companies.

Marius
MVI Data Recovery

ReplyQuote
Posted : 19/10/2010 10:25 pm
tsweet
(@tsweet)
New Member

I'm in New Hampshire.
I guess what confused me about this was that I got no errors in encase during acquisition.

ReplyQuote
Topic starter Posted : 20/10/2010 1:44 am
apfelkraft.ch
(@apfelkraft-ch)
New Member

All clear now…. D

ReplyQuote
Posted : 01/06/2011 4:05 am
Share:
Share to...