| Author | Message | ||
     Adam Sanderson Username: adamsanderson Registered: N/A |
I am conducting an experiment to see if I can recreate a raid array within R-Studio. I’ve done this before with various external hard drives that had been configured in RAID 0 but this time I’m having difficulty. I have a customer who has a G-Raid2 Mini which the enclosure is faulty. I purchased a brand new G-Raid2 Mini from G-Technology so I can play around with the device to see if I can recover the data from a perfectly working unit. It has two 2.5” SATA 250GB hard drives inside. I hooked the drive up to a Mac G5 and formatted it using the Apple partition map scheme. (the original customer had done the same) The drive now shows up as 500GB and is fully functional. Now, I take the enclosure apart and remove both 2.5” drives from the enclosure. I’ve got them now connected via eSata to a PC. Using RAID Reconstructor I scan the drives and it actually find parameters which are supposedly the correct ones. It says Block size/ Rotation: 8 Sectors / 4KB. I know open R-Studio and create a virtual striped set with the two drives in the proper order. I set the block size to 4KB and scan the drive completely. When it finishes it never finds the partition it only comes up with “Extra Files”. I’ve even gone as far as to manually try every possible block size from 4KB to 1MB and I let it scan the drive for about 20 minutes to see if it can find the original partition but it never does. The only other parameters I see in R-Studio to change is “Number of rows” and “Block Order” which is either “default” or “custom” At this point I’m not sure what to do next. I’ve tried every possible setting in R-Studio to try and get it to see the partition but I haven’t had any luck. Anyone have any suggestions? FYI - I just purchased a WinHex specialist license but I have never used it before. Please forgive me as I am just beginning to learn about this subject but hey we all have to start somewhere.... | ||
| René Axnix Username: reax Registered: N/A |
Have you tried to copy a "known file" (p.e. 2MB textfile) to the raid? After you've copied this file to the raid0 maybe you can find out the way the raid stores it's data (with winhex). | ||
| W. Spiegl Username: ws Registered: N/A |
If I have understood this right, you have a new Mac (Apple) Raid 0. In case that you should have found out a solution, please inform me. Some days ago I reported in the german forum, that XWF seems to be unable to connect two Mac Raid 0 HDs together. It works fine with another forensic tool, but I got no information till now how this could be done with X-Ways. | ||
| René Axnix Username: reax Registered: N/A |
neeee. ;-) Here is the talk of a G-Raid2 Mini (external enclosure of two 2,5" harddisks) formated with a Mac. | ||
| Adam Sanderson Username: adamsanderson Registered: N/A |
Yes, I used a deep spar disk imager to completely wipe both drives clean. I then put them into the enclosure and created the RAID array. I then put a small text file on the drive and attempted to use a WinHex to see the data. I was able to locate the data from the text file in WinHex. However, that is as far as I got. I'm sure exactly what I'm looking for in terms of being able to figure out the RAID parameters from this point. I have the general idea that I should be able to see where some of the data is on one drive and some on the other but I don't know how to convert this into actual RAID settings. I've search online for information regarding how to do this but thus far have been unable to locate any good source of information on this topic. | ||
| W. Spiegl Username: ws Registered: N/A |
That was just what I talked about. An external Raid 0 created by a Mac. The example is still online. www.bootablecd.de/Macraid0.zip | ||
| Adam Sanderson Username: adamsanderson Registered: N/A |
I finally figured it out - turns out that apparently R-Studio is unable to read the file system for this device. I used another program called UFS explorer which I was able to successfully recreate the raid and recover the data of the drive. I would have thought that R-Studio could have done this but apparently not... |