Question about RAID...
 
Notifications
Clear all

Question about RAID configuration

7 Posts
5 Users
0 Likes
2,609 Views
(@panda)
Posts: 2
New Member
Topic starter
 

Hi,

I am planning to set up a forensic workstation. I want to install the OS on a SSD and the data on a RAID 5. The onboard RAID controller supports RAID 5. But is this advisable or should I consider buying a dedicated RAID controller card? And can I expand the RAID if I need more storage and want to add more drives at a later time?

Thanks!

 
Posted : 19/02/2019 12:38 am
(@athulin)
Posts: 1156
Noble Member
 

The onboard RAID controller supports RAID 5. But is this advisable or should I consider buying a dedicated RAID controller card?

That kind of general question is probably not possible to answer. What exactly is this workstation, what is the onboard controller, and does it have any history of giving problems or becoming a bottleneck? How does it's planned lifetime look, and for how long will you be getting patches? How does it behave when there's a problem – does it allow you to go on working, or does it require you to drop everything you're doing, replace the bad disk, and wait for it to be restored before it will allow you to work with it again? (That can be unpleasant if you're on a tight schedule …)

If you state the brand and model, someone here may know more about it.

And can I expand the RAID if I need more storage and want to add more drives at a later time?

Who knows? RAID5 was not designed to be extended, but some providers may allow it. The best way to get that question answered is to ask the manufacturer (pre-sales support) or someone who has worked with the device you're considering.

If you have a backup design as well – which you should – you could probably use that for adding drives later Ensure the backup is OK, add drives tp the main RAID, reestablish the RAID and then restore the backup to it. Then do the same on the backup side, if you need.

 
Posted : 19/02/2019 6:11 am
(@panda)
Posts: 2
New Member
Topic starter
 

I have a Think Station P500 and otherwise a limited budget. I don't have any experience on how the internal SATA onboard controller performs. Does anyone have experience with that or likes to share his configuration with me?

I would also appreciate any recommendation on how much storage I should use. As for now, we have very limited number of cases but I would like to have enough storage to not create a bottleneck in the future. For backup of case and image data I have a dedicated fileserver which is also regularly backed up. So I would only need enough storage for ongoing cases.

Any suggestions or ideas are greatly appreciated.

 
Posted : 19/02/2019 5:10 pm
jaclaz
(@jaclaz)
Posts: 5133
Illustrious Member
 

I have a Think Station P500 and otherwise a limited budget. I don't have any experience on how the internal SATA onboard controller performs. Does anyone have experience with that or likes to share his configuration with me?

I would also appreciate any recommendation on how much storage I should use. As for now, we have very limited number of cases but I would like to have enough storage to not create a bottleneck in the future. For backup of case and image data I have a dedicated fileserver which is also regularly backed up. So I would only need enough storage for ongoing cases.

Any suggestions or ideas are greatly appreciated.

A few side notes.

The most relevant one is that particularly in a forensic scenario RAID is NOT "storage" 😯 but rather "hopefully quickly recoverable temporary storage" or better "hopefully quickly recoverable temporary workspace".

The idea behind RAID (generally) is not about "storage" (that is what backups and copies are for) it is about (fast in reading) accessibility 24/7 all year round, and, in case of fault, minimal (or no) downtime (though with a much lower throughput during rebuilding, if done "online"), all in all, think "lan server".

If you increase arbitrarily the array size, rebuilding in case of a disk fail won't be anyway "quick".

That Think Station P seems like using a "plain" Intel RST controller, which is known (but maybe this does not apply to the specific Lenovo version model) to be extremely slow in writing, at least in RAID 5.

Personally I would use a "proper" hardware RAID card.

jaclaz

 
Posted : 24/02/2019 5:48 pm
JaredDM
(@jareddm)
Posts: 118
Estimable Member
 

Using a dedicated RAID card has a lot of advantages over motherboard onboard RAID. To name a few

1. Increased speed, especially for more complex RAID types like RAID 6 which require more calculations.
2. More RAID levels available
3. Far more features for RAID upgrade and migration if you want to expand it or reconfigure it later on (just be sure to check what each RAID card does and doesn't support as they can vary widely in this regard).
4. Less likely to just randomly go stupid and screw up the RAID (onboard RAID is notorious for this). At least most cards are less likely to do this, but some such as PERC cards do still tend to randomly throw half the drives offline and go stupid.
5. Ability to configure things like write caching on the drives, which can cause corruption in cases of sudden unexpected power off. I can see how this might be especially important when things need to be forensically sound.
6. Battery pack support (for better RAID cards) which can protect the write buffer in the event of a sudden power outage and preserve that data.

However, none of that is to say that RAID is the same as a backup. We only use RAID 6 here which can sustain two drive failures, yet we still backup everything important. Even with extra redundancy, you'd be surprised how often a RAID can go down or get corrupted, especially when it's under heavy usage constantly.

 
Posted : 24/02/2019 8:29 pm
jaclaz
(@jaclaz)
Posts: 5133
Illustrious Member
 

We only use RAID 6 here which can sustain two drive failures, yet we still backup everything important.

And this opens the "next" can of worms 😯 .

RAID 5 is IMNSHO (or should be) a "thing of the past".

A lot of debate is ongoing whether nowadays it makes more sense to choose a RAID 6 or a RAID 10 (1+0) as both have some advantages and disadvantages. (namely 6 is "safer" and "cheaper" but 10 has far superior "write" performance, at a a higher cost per Gb while keeping a "decent" reliability).

The "variable" that many people don't take into consideration is that the size of the single disks used in the array(s) does have a significant impact in both reliability and rebuild time (in case of disaster).

Everyone (understandably) tries to maximize the capacity available for the dollars spent without understanding that when you double the capacity of the single disk you effectively (almost) halve the reliability of the system, particularly on 10.

There is an interesting paper by DELL, here
http//en.community.dell.com/dell-groups/dtcmedia/m/mediagallery/19861480

In a nutshell
For "storage" I would go for 6.
For "workspace" I would go for 10.

jaclaz

 
Posted : 25/02/2019 10:46 am
(@jahearne)
Posts: 35
Eminent Member
 

Nearly every RAID that I've seen all the drives are the same, same manufacture, same model, same firmware versions, same dates, same lot, and same mean time between failure rate. One drive fails, the chances of another drive failing are pretty high before the degraded RAID rebuilds is pretty high.

Mix and match drives if you can.

 
Posted : 05/03/2019 10:49 pm
Share: