Quantcast
Channel: Forensic Focus Forums - Recent Topics
Viewing all articles
Browse latest Browse all 20102

General Discussion: MacPro RAID

$
0
0
Without more knowledge about the box you are in a bit of trouble. Macs offer a software RAID and optional hardware RAID controller. Macs are very intuitive in that if you put the disks back into the Mac and it was using a software RAID the Disk Utility application would tell you which disk is which. See this Apple developer article for info about Apple software RAIDs: http://support.apple.com/kb/HT2559 With as many disks as you have I would doubt all four disks are set to either a RAID 0 (2tb of disk size without redundancy and several points of failure). I also doubt you would have two separate RAID 1 volumes (two 500Gb volumes using the mirrored disks). Additionally as said before, mirrored disks are readable without rebuilding a RAID and it sounds as though you aren't in that situation. So RAID 0 is a small possibility and it sounds RAID 1 is not a possibility at all. You are left with a possible concatenated RAID depending upon the version of OSX being used or a hardware RAID. The hardware RAID could be literally anything the hardware RAID controller can support (0,1,5,6,10,50,60,etc). You need to take in to account what the Mac was being used for an by whom. This may help you decide on what type of RAID was being used. Do you have access to the Mac still? If so, check for a hardware RAID controller. You could always DD the original evidence to new drives and plug the cloned drives in the Mac. Look at Disk Utility to rebuild the RAID and see what it tells you. Best, Dave

Viewing all articles
Browse latest Browse all 20102

Trending Articles