Results 1 to 10 of 10

Thread: pulling informaton from raid

  1. #1
    Junior Member
    Join Date
    Feb 2008
    Posts
    36

    Default pulling informaton from raid

    Alright, I have a bit of a hum-dinger (forgive the term) I'm with a team that needs to pull data off a computer with raid. The challenge:

    1) One of the 9 drives was stolen
    2) The server is running triple Pentium processors, has only ISA slots, no video card, and a strange scsi to ATA interface.
    3) We were unable to discover if the network card is still working, as it is missing a link light, and the only OS we had available was vista.

    I am going to be using backtrack tomorrow to play around with it, and I was wondering what tools I should focus on, or if anyone even thinks its worth the effort.

  2. #2
    Just burned his ISO
    Join Date
    Apr 2008
    Posts
    9

    Default

    What kind of RAID is it? If it were 5 or 6 you could just put a new drive in and rebuild/recalculate? 3 and 4 you should be able to do the same thing if it wasnt the dedicated parity drive stolen.

    You probably know this already though, but just thought id mention it.

  3. #3
    Junior Member
    Join Date
    Feb 2008
    Posts
    36

    Default

    Yup, I do know that much. However, we have no clue what raid level was used. They could be all mirrored, though that is pretty unlikely.

  4. #4
    Senior Member streaker69's Avatar
    Join Date
    Jan 2010
    Location
    Virginville, BlueBall, Bird In Hand, Intercourse, Paradise, PA
    Posts
    3,535

    Default

    If it's a RAID 5 and a drive is missing, then the system should still be bootable. You should just be able to get another drive of equal or greater size and drop in and rebuild the array, a hardware RAID controller will probably do that automatically when you plug it in. Hopefully you're not using a Software Array, as they tend to be a little more finickey.
    A third party security audit is the IT equivalent of a colonoscopy. It's long, intrusive, very uncomfortable, and when it's done, you'll have seen things you really didn't want to see, and you'll never forget that you've had one.

  5. #5

    Default

    Find out what raid your using, enter the raid bios either ctrl A or what ever controller your using, that'll tell you (you know this already...) & as all the other replys suggested, plugging in a different or new hard drive, should auto rebuild the array. When you boot up, does it give you an error like degraded array etc? You can usually get around this in the bios

  6. #6
    Member s1lang's Avatar
    Join Date
    Sep 2007
    Posts
    189

    Default

    Would Helix be better for your job over Backtrack mate??
    Or as well as

  7. #7
    Senior Member streaker69's Avatar
    Join Date
    Jan 2010
    Location
    Virginville, BlueBall, Bird In Hand, Intercourse, Paradise, PA
    Posts
    3,535

    Default

    I would think if it's a 9 drive array, there should have been at least 1 Hotspare in place. And if there was, the array should have rebuilt itself to the hotspare when one drive went on walk-about. Unless there was already a dead drive and the hotspare was already in use.
    A third party security audit is the IT equivalent of a colonoscopy. It's long, intrusive, very uncomfortable, and when it's done, you'll have seen things you really didn't want to see, and you'll never forget that you've had one.

  8. #8
    Junior Member
    Join Date
    Feb 2008
    Posts
    36

    Default

    I think I'm in more trouble than that. What I thought was the raid controller... isn't. It would seem the scsi/raid controller is missing. I'm pretty sure its impossible to rebuild the data without the same exact card (at least brand).

    I'm going to try to hunt up a scsi controller and check each drive, one at a time, just in case they weren't all part of the array.

    Oh, and its an NEC 4200 RISC, if that helps any. From what little I've found, it was one of the first NEC machines with RISC architecture.

  9. #9
    Senior Member streaker69's Avatar
    Join Date
    Jan 2010
    Location
    Virginville, BlueBall, Bird In Hand, Intercourse, Paradise, PA
    Posts
    3,535

    Default

    Quote Originally Posted by GunMonkey View Post
    I think I'm in more trouble than that. What I thought was the raid controller... isn't. It would seem the scsi/raid controller is missing. I'm pretty sure its impossible to rebuild the data without the same exact card (at least brand).

    I'm going to try to hunt up a scsi controller and check each drive, one at a time, just in case they weren't all part of the array.

    Oh, and its an NEC 4200 RISC, if that helps any. From what little I've found, it was one of the first NEC machines with RISC architecture.
    Do you know what SOL means? Because that's pretty much what you are right now, if it is a real hardware RAID. Hopefully you have the data on Tape somewhere.
    A third party security audit is the IT equivalent of a colonoscopy. It's long, intrusive, very uncomfortable, and when it's done, you'll have seen things you really didn't want to see, and you'll never forget that you've had one.

  10. #10
    Member Oneiroi's Avatar
    Join Date
    Jul 2008
    Posts
    59

    Default

    Quote Originally Posted by GunMonkey View Post
    I think I'm in more trouble than that. What I thought was the raid controller... isn't. It would seem the scsi/raid controller is missing. I'm pretty sure its impossible to rebuild the data without the same exact card (at least brand).

    I'm going to try to hunt up a scsi controller and check each drive, one at a time, just in case they weren't all part of the array.

    Oh, and its an NEC 4200 RISC, if that helps any. From what little I've found, it was one of the first NEC machines with RISC architecture.
    The RAID data stripe-ing I have found to be standard across most hardare, i.e.

    I was able to take a raid 1 array of 2 x 40GB IDE disks off a dead Promise SX6000 PCI raid card, and get the data by using an onboard adaptec raid controller.

    I have even been able to get data from a Netgear SC101 doing this ... even though it uses a propriatry data format, as long as the machine with the raid controller has the drivers installed you can get at the data.

    Anyway the best thing you could do is plug in a spare array controller, hook up the drives, and boot the machine, making sure you hit whatever key combination to enter the cards setup BIOS menu, navigate through whatever menus to see if the drives and thier configuration is detected.

    A very square peg > round hole > Sledge hammer approach, but it could work.
    ---------

    OSX 10.6
    Advent Vega (Tegra 250)

    Working on getting BT5 working on the Vega

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •