Rebuild RAID5 with drive images in R-Studio

[hiljak]

Hello,

I am trying to rebuild a RAID5 array that consists of three 36GB SCSI hard drives (NTFS). I have taken images of each drive with R-Studio, however, each image shows no files (only 1 folder called ROOT). I have added all three images to a virtual RAID5 in Rstudio and have scanned the virtual disk. This task completes with an "extra found files" entry on the left, however, inside this shows only one folder named ROOT. I have the following questions:

1. Should the drive images of RAID5 members show any data within other than the ROOT folder?

2. Is there anything special I need to do to the images prior to trying to reconstruct them?

3. I have read a post which talks about finding the stripe size and offset of each drive. How is this information found?

Thank you.

[hiljak]

Also, when I view any of the 3 drive images (or view the virtual RAID5) from within Rstudio's hex editor, all the bytes are 6c. Does anyone know what this means? Does this mean 6c has been written to the drives (like a low level format?)?

[Steve]

look at the original drives with a hex editor , and compare to the images..

[hiljak]

Hello Steve, when I look at the actual drives with RStudio's hex editor, it also shows all 6C for every byte of every sector. What does this mean and what can cause this to happen to all 3 drives? Thanks for your help.

[Steve]

plug the drives back into a scsi controller , and look that them with a dos based hex editor.
I'm thinking the usb adapter may be causing an incorrect reading
if the readings are correct , I'm afraid the data is gone

[hiljak]

Hello, I connected the drives to a RAID card, viewed with hex editor and again find all 6C on all the drives. I also connected another SCSI drive to the Tableau device (from another RAID set) and it reads the data fine. The drives are definitely full of nothing but 6C for every byte.

What can cause this? Does this mean this is sabotage, like someone fill all sector with 6C in winhex??

What does a drive look like that has been low level formatted? Does it have all 6C? thanks.

[pepe]

Hi,

It seems like the drives has been filled with 6C indeed. The controller card should have an option like 'Media test' or something like that. If someone used that prior the drives got to U, he did a nice trick to the data
I'm afraid it is gone for good...
regards,
pepe

[hiljak]

Hello Pepe, Is there any way to tell when this was done (i.e. like a time date stamp). I would like to know if the previous person that tried to get the data did this (by acident or otherwise). Thanks.

[cryoborgofthevenus]

Hi ! try using EnCase or FTK...hope that helps...

[hiljak]

Hello,

Encase also shows no entries for last modifed, etc..

When you low level format a drive, what does it look like in a hex editer after (i.e. is it all "11" in text and all "6C" in hex?)?

Also, what does it look like if you just delete the partition or initialize from the RAID controller? I'm trying to figure out what this person's ex-Network Administrator did to destroy their chance of data recovery. Can someone help me figure out what appears to have have caused this current status of the data structure (or lack thereof!)

Thank you.

[pepe]

Hi,

If U have the controller, try scanning media on a spare drive and see what values does it have afterwards.

pepe