Quantcast
Channel: Forensic Focus Forums - Recent Topics
Viewing all articles
Browse latest Browse all 20109

General Discussion: Finding RAID...

$
0
0
Find MBR/Boot/Superblock to figure out what file system is used. If NTFS it's pretty easy to understand if drive belonged to RAID or not - find MFT (by GREP "FILE0" or hex). Each record has attribute "MFT Record No", follow it's sequence. If > 150 records follow sequentially, then data isn't sliced and spread across drives (sinle drive). If sequence breaks after 1/32/64/128 records (file record = 1kb), then it's part of RAID0/5/6...With Ext it's more tricky. Here you can find info about MFT record structure and where to find MFT record No attribute.

Viewing all articles
Browse latest Browse all 20109

Trending Articles