±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 3 Overall: 36445
New Yesterday: 2 Visitors: 146

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

raid5 recovery

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Page 1, 2  Next 
  

krishna
Member
 

raid5 recovery

Post Posted: Jul 08, 15 00:43

hai members

i have small issue with reference to recovery of data from the failed raid 5 server. the server consists of 4 hard disks of same capacity. the server is not booting stating the file system corrupted. the OS running was windows 2003 server. i took the physical image of all the 4 hard disks, subjected to Reclaime Raid recovery software. Reclaime rebuilt the raid, and asked to use recovery software. i used the reclaime recovery software for recovering the data. the problem is most of the files recovered shows the size as 0, few of them not opening, and few files which show some size are opened but the data is not complete. all the files recovered are audio files.

i wanted to know what could be the reason for these anomalies? how do i justify the recovery. pl help me what further can be done in this case.
_________________
krishna m
cyber forensic expert
india 
 
  

mscotgrove
Senior Member
 

Re: raid5 recovery

Post Posted: Jul 08, 15 03:19

Lots of possible reasons

1) The RAID was very corrupted
2) The disk order is wrong
3) The reconstruction has the wrong RAID pattern or stripe size, or starting point.

Can the software produce a flat disk image file, and you can see if the RAID reconstruction is correct.

For NTFS disk, the $MFT is very good point to examine. It is long, and largely sequential, with an easy pattern to follow by hand. You will need a good Hex sector viewer to help.
_________________
Michael Cotgrove
www.cnwrecovery.com
www.goprorecovery.co.uk 
 
  

nightworker
Senior Member
 

Re: raid5 recovery

Post Posted: Jul 08, 15 13:46

learn your raid card standart parameter and reconstruct your disks
r-studio i prefer but the best softcenter raid recovery  
 
  

krishna
Member
 

Re: raid5 recovery

Post Posted: Jul 08, 15 23:29

- mscotgrove
Lots of possible reasons

1) The RAID was very corrupted
2) The disk order is wrong
3) The reconstruction has the wrong RAID pattern or stripe size, or starting point.

Can the software produce a flat disk image file, and you can see if the RAID reconstruction is correct.

For NTFS disk, the $MFT is very good point to examine. It is long, and largely sequential, with an easy pattern to follow by hand. You will need a good Hex sector viewer to help.




thanks for the response, i wanted to clarify that,
the disk order is correct, and the software produced flat disk image file. i run the relcaime data recovery tool on the flat disk image file only, but the results are not encouraging as i stated earlier i.e zero size files, show some size but does not play, some play with lot of interruptions as these are audio files.

regards,
krishna m  
 
  

mscotgrove
Senior Member
 

Re: raid5 recovery

Post Posted: Jul 09, 15 01:04

If you do some data carving on the flat image, do you get good files, eg good JPEGs.

It is most likely the 'flat' image is not actually correct.

This is why I suggest you look at the $MFT (often found at sector 0x60003f or 0x600800) to see if it a sequential file. Each entry has a reference number and I would expect this to increase with most 0x400 byte entry.

ie Look at your raw data at every stage rather than just the end result.
_________________
Michael Cotgrove
www.cnwrecovery.com
www.goprorecovery.co.uk 
 
  

ReclaiMe
Newbie
 

Re: raid5 recovery

Post Posted: Jul 12, 15 18:08

You may want to file a support request with us, with more details, like RAID parameter set XML as it was recovered, and we'll take a look.  
 
  

einstein9
Member
 

Re: raid5 recovery

Post Posted: Jul 20, 15 21:55

- krishna
hai members

i have small issue with reference to recovery of data from the failed raid 5 server. the server consists of 4 hard disks of same capacity. the server is not booting stating the file system corrupted. the OS running was windows 2003 server. i took the physical image of all the 4 hard disks, subjected to Reclaime Raid recovery software. Reclaime rebuilt the raid, and asked to use recovery software. i used the reclaime recovery software for recovering the data. the problem is most of the files recovered shows the size as 0, few of them not opening, and few files which show some size are opened but the data is not complete. all the files recovered are audio files.

i wanted to know what could be the reason for these anomalies? how do i justify the recovery. pl help me what further can be done in this case.


What is the Server Model?

I can have a quick look @ it if you want via TV (teamviewer)  
 

Page 1 of 2
Page 1, 2  Next