Odd RAID results

[drc]

I'm working on a case that had 3 18.6gb seagate SCSI drives in a RAID (presumably RAID 5 but client does not know). Two of the disks had dropped from the array. When I examined them I found them to be reporting 0 LBA. I regenerated the translator using the appropriate commands and was subsequently able to image the three disks.

Putting the RAID back together is becoming a challenge though. I thought it was just a simple RAID 5 but none of the configurations I have tried have worked so far, though I have gotten pretty close. The XOR test in RAID reconstructor gives a fairly odd looking result, and though I am able to see the file structure in the reconstructed image, larger image files are all corrupted (mostly BMPS with one or two large black bands across the picture).

Any thoughts?

Attachments

[HDD Spaz]

you havent said if you have found the block size. find this first. then starting sector. also look at the make of the raid card. 3 disk raid 5 should be easy once you have done these things.

[drc]

you havent said if you have found the block size. find this first. then starting sector. also look at the make of the raid card. 3 disk raid 5 should be easy once you have done these things.

I agree that it should be, and it has been plenty of other times. Block size is 64kb, found the starting sector, make of the RAID card is unknown.

[drc]

Figured it out. Customer apparently pulled one drive from the array and messed with it.

[quasimodo]

I agree find header and stripe size. All the commercial Raid Recovery Tools I have used including this one are a serious disappointment. Use Winhex Forensic or Professional edition and reassemble on the fly.

If problems pm or email me I might be able to assist

[quasimodo]

glad to hear that you figured it out

[drc]

Apparently parity gets messed up when someone partially overwrites one of the drives and then forgets to mention that.

[maux]

Oh no!

I hope your charging them for wasting your time!

Any ideas for attempting further recovery?

-maux

[hddguy]

Sounds like array was running in degraded mode. Simply rebuild with a virtual disk in place of the one customer messed with.

[drc]

Correct