I have images only of 2 Hdds from HP ProLiant ML310e Server which are almos identical so I suppose they worked in RAID1. Server worked with WinServ2012 R2. When I list partitons I have two NTFS partitons on the first 100GB of disk. After that there is space marked as unpartitioned but its not true. There are some data structures like this:
Code:
00000000: 7856 3412 ffff ffff bdae 7f0c 0000 0000 xV4.............
00000010: 1bfb 3a53 0000 0000 7cf0 3a53 0000 0000 ..:S....|.:S....
00000020: 2f64 6576 2f73 6462 0000 0000 0000 0000 /dev/sdb........
00000030: 0000 0000 0000 0000 0000 0000 0000 0000 ................
00000040: 0000 0000 0000 0000 0000 0000 0000 0000 ................
00000050: 0000 0000 0000 0000 0000 0000 0000 0000 ................
AND MORE DATA
From SleuthKit view this part of disk is not unpartitioned:
Code:
DOS Partition Table
Offset Sector: 0
Units are in 512-byte sectors
Slot Start End Length Description
000: Meta 0000000000 0000000000 0000000001 Primary Table (#0)
001: ------- 0000000000 0000002047 0000002048 Unallocated
002: 000:000 0000002048 0000718847 0000716800 NTFS / exFAT (0x07)
003: 000:001 0000718848 0209694396 0208975549 NTFS / exFAT (0x07)
004: ------- 0209694397 1953525167 1743830771 Unallocated
as I see the same bytes are located on header of every sector.
After that I see some data but unreadable. Is it some sort of software raid ? I think its not because its only used on third partition