Quantcast
Channel: Forensic Focus Forums - Recent Topics
Viewing all articles
Browse latest Browse all 20112

General Discussion: "RAID" help!

$
0
0
There is something "wrong" (no offence intended <img src="images/smiles/icon_smile.gif" alt="Smile" title="Smile" /> ) in your report, and IMHO *something* doesn't sound "right" in your hypothesis. <img src="images/smiles/icon_eek.gif" alt="Shocked" title="Shocked" /> A Dell Power Edge is a "Server Class" machine. While it is possible (though highly improbable) that it booted from network (PXE booting) an OS residing on another Server in the network, still it should have hosted data, what would otherwise "serve"? If it "served" data residing on another machine on the network, it would have been more than anything else a "router" (and a typical router would have no local storage devices if not a - minimal - often a CF card or similar, hosting the actual OS). So, while it is entirely possible that the three disks were wiped (or have their content deleted, one way or the other) it is at least improbable that that machine was setup by a mad hatter that bought a server and added to it largish mass storage devices to later use it as an OSless router. Now the common ways to set up a server with a RAID controller: http://en.wikipedia.org/wiki/RAID are typically only four: 1. A Raid 0 (which is not really-really a RAID) with EVEN number of disks (2 or 4, etc.) &lt;- faster but with no redundancy 2. A Raid 1 which again would use an even number of disks &lt;- pure "mirroring" 3. A Raid 0+1, but again it would use an even number of disks (minimum 4) 4. A Raid 5 that needs at least 3 disks (and the 3 disks setup is actually one among the most common ones). &lt;- "real" redundancy with block level striping and distributed parity. This scheme might help:On a normal disk you have sequentially on the disk itself: block A block B block C ...etc. When you have the same on a 3 disks RAID: block A is on the FIRST disk block B is on the SECOND disk &lt;here a parity block for A and B is inserted and stored on the THIRD disk&gt; block C is on the FIRST disk&lt;here a parity block for C and D is inserted and stored on the SECOND disk&gt; block D is on the THIRD disk So, when you access a disk as "single disk" (or an image of it) there will be: First disk that will start, like any "normal" disk with a MBR Second disk that (unless a mirror of the MBR has been made exactly on the beginning on the second block) will NOT have a MBR as first sector. Third disk that will also NOT have a MBR as first sector (should be detectable visually) contains "parity data" (please try reading this temporarily as "hex garbage") So, when you access the three images as single disks, one and one only should have as first sector a MBR (please read as "have partitions"), and that would be the first disk. If you can find "partitions" on two of the images, it sounds like there is an issue *somewhere*. A logical explanation could be that the disks were not set in RAID 5 but rather in a two disks RAID 1 (pure mirroring) + a (unused) spare, but then two of the images should be identical between them. <img src="images/smiles/icon_confused.gif" alt="Confused" title="Confused" /> jaclaz

Viewing all articles
Browse latest Browse all 20112