| Author | Message | ||
     ACForensics Username: acforensics Registered: N/A |
I have a RAID 5 array with 3 disks. Disk 1 has the complete MBR that points to a NTFS partition at sector 63. No problem so far. When I search Disk 1 for ANY NTFS partition, none are found. Still no problem, because of the disk striping right. I find the partition on Disk 3, on sector 63. But the stripe size is supposedly 128 sectors. How can it be that, when assembled with this stripe size, the MBR will properly point to the partition table on sector 63 of the assembled array? Am I missing something? Thanks for any help or comments. A | ||
| Paul Mullen Username: pcguru Registered: 1-2006 |
Remember that if this is RAID5 there is a parity stripe - essentially a bitwise AND on the two data stripes. So if sector 63 of disk one had a boot sector, and logical sector 191 (which would be sector 63 of the second stripe) was all zero, then sector 63 of the parity stripe would be an exact copy of the boot sector. That would make it hard to determine which one was the real disk 1. Often there are a few empty sectors (some of which may have housekeeping information)before the start of the RAID stripe data. Of course if sector 191 had just a few non-zero bytes then some of the values in the boot sector would be invalid. Looking for the copy of the boot sector at end of the drive and then looking for $MFT FILE records might give more clues. | ||
| aban Username: aban Registered: N/A |
hi, One of my customers have RAID 5 array too, three disks, disk failed, only disk one can work, disk 2 and 3 lost MBR, NTFS partition. some like with acforensics. "Looking for the copy of the boot sector at end of the drive ", I first time know this, is it useful? I will try this, Thanks. -------------------- www.softsea.com |