Sometimes you can face cases where software RAID starts from some LBA in the middle of the drive. These are crazy cases but there are some tricks how to find out the start offset of RAID...
Start offset for RAID can be defined on following considerations:
1. 0th sector is simplest case common to many hardware RAID controller;
2. Partition start is common to software RAID where each drive has 3-4 partitions, and RAID is assembled on largest partitions;
3. MBR sector or another boot record assume that 0th RAID sector contains MBR;
4. Make offset taking in account Boot/SuperBlock/Volume Header, often on RAID file system starts from 0th sector without MBR or other. But give weight to required structure doesn't have to be in 0th sector. For example 0th superblock of ExtX is offset by 1024 bytes from partition start;
5. Define offset using redundancy (if it exists) if redundancy converges from some sector then it can be start. For mirror it's necessary to create mirror with any drive order. For RAID 4 and 5 it's necessary to verify XOR convergence. Drives order, block size and algorithm are not essential for XOR;
6. To define the border of period by files is simplest case with MFT records are broken to continuous pieces not oversize one RAID block when search by raw recovery. If there are XOR and RS blocks then they fall out. When period border is known then try back a whole number of periods and use this value. Partitions can be found by raw recovery or quick disk analysis;
7. Look out for miscellaneous meta-data of software RAID and logical disk volume. DE allows LDM, MDADM and LVM.
It is few recommendations but experience users know another ones. You can share them here
Data recovery from RAID arrays with the help of Data Extractor RAID Edition
1 post • Page 1 of 1
Who is online
Users browsing this forum: No registered users and 2 guests