Ethical Hacking Training at InfoSec Institute

Learn to find vulnerabilities before the bad guys do! Gain real world hands on hacking experience in our state of the art hacking lab. Course designed and taught by expert instructors with years of penetration testing experience. 12 student maximum in every class. Certification attempt included in every package.
Computer Forensics Training at InfoSec Institute

Gain the in-demand skills of a certified computer examiner, learn to recover trace data left behind by fraud, theft, and cybercrime perpetrators. Discover the source of computer crime and abuse at your organization so that it never happens again. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors.




Computer Forensics Computer-Forensics
[Top] [All Lists]

Re: Recovering files from RAID 0 set

Subject: Re: Recovering files from RAID 0 set
Date: Fri, 12 May 2006 12:44:23 -0400 (EDT)
On 11 May 2006 pentesticle@yahoo.com wrote:

I have a situation where one of the people working an investigation
attempted to turn on a computer and a static shock arced through the
on-off switch. The PC would not recognize any of the RAID drives inside.
I pulled the CMOS battery and unplugged, then the BIOS found the drives
but I'm guessing the MBR is bad or something because it detects the
drives, but is unable to find the OS.

I wonder if the RAID set in question was software or hardware created.  As
the motherboards that have on boartd RAID support are quite common now,
based on information you provided, most obvious explanation that I can
think of is that your system had a RAID set created in BIOS.  When the
power surge occured (or when you reset the CMOS battery), it lost it's
BIOS settings, including on board RAID settings.

If the motherboard indeed does RAID, then I'd consider cloning the disks
for backups, and attempting to re-create the RAID using on-board BIOS.

I need to recover some data from the RAID 0 set. What would the best
method be to do this and would it be likely that I can recover the MBR
to boot the system?

Windows XP SP2, SATA RAID 0 drives...

Thanks for any help


Signed:
//Stany
-- 
+-------+ Stanislav N Vardomskiy - Procurator Odiosus Ex Infernis[TM] +-------+
| "Backups we have; it's restores that we find tricky." Richard Letts at ASR  |
| This message is powered by JOLT!  For all the sugar and twice the caffeine. |
+-+ 10570 + My words are my own.  LARTs are provided free of charge + 10533 +-+

<Prev in Thread] Current Thread [Next in Thread>