RAID Data Recovery from Failed Arrays

all right so raid is fun this is going to be the fun part this is where it all comes together I do want to mention one thing about software on the software side we are going to use we are doing this manually there are tools that can now reassemble raid arrays somewhat automatically but this is one of those chicken and egg kind of things right if you don’t know what to do and you don’t know why it’s doing it or what the layout is and those kind of things then it’s a lot of work there are many ways that you can process raids I like to do it visually because I feel like if I’m looking at a photo I can figure stuff out quicker there are people and even like before like Hoffman in the Netherlands there’s a company who’s written stuff about doing analysis of gaps in space inside of a raid array is a very difficult task to do but they’ve written some scripts to do analysis I’ve been to their class and done their stuff I find it difficult to teach I find it difficult to talk about so I like to do it more graphical and so there are a number of ways with which you can do raid raid Reconstructor will do one thing our studios will do a completely different one if you look at the documents for our studio if you wanted if you bought off-street our studio our studio will do a raid reconstruction but you got to do it all manually they have like a document that’s like 20 pages long it tells you how to search for gaps and try to figure out what the gap space is so there is a scientific method with which you can examine gaps where on page 150 what 160 150 150 okay mm-hmm so my methods not the only method that you can use to do these things and you can spend a lot of time doing analysis you can look at segments you can look at stuff I will tell you mine addresses the two main areas of raid that you’re going to see raid 0 and raid 5 there is also raid 5e and raid 5 double e I will tell you right now if somebody tells you I have a raid 5 e or double e this process will not work exactly the same I will tell you you should use if you get raid 5 e or double e one of the automatic tools because you’ll have an additional parity that will be distributed that you won’t be able to easily track my hand or manually you will need an automatic tool that will assemble them but most of those controllers are higher in controllers so you’re looking at like IBM controllers or you’re looking at HP compaq trader raid controllers things like that so as soon as you hear those words and it’s not like standard you know three where or Adaptec or something in the lowering category the sub $1000 category which is mostly what I see in NASA’s I do get the others from time to time but if you say to me oh look I’ve got an HP I’m not going to use this method to do this I’m going to use an automatic piece of software that will search for the segment’s some of those drives in those raid arrays such as a compact raid array actually right segment numbers and stuff in there so you can figure them out if you knew where to decode that content so in those cases those are the ones that work really well with something like ufs explorer there is another tool that’s about a hundred and seventy dollars this tool that i have found it works great on 5e in double e so you have to think four is one one of the other ones i found is this is not this is not a real fancy tool but it does work and it does give me the configuration and it’s roughly 170 bucks or so and it will give me the configuration and then we’ll lay it out it does not make my job easy because I have to spit out a solid image so this is not practical for some large raid arrays if you handed me 4 4 terabyte drives that’s sixteen terabyte or whatever it is it’s going to be at that point I’m going to have a very difficult time spitting that out into a single image that’s probably not going to work so I would want to use something called the virtual image so there are ways where you can use a XML file to make the virtual image work so there are things that won’t fit exactly into this category but it will cover like 90% of what the rate of rays are that are out there so there’s a there’ll be a couple of if this is where we’ll defer that or do something that I get a lot of raids that are from Lacy’s Nast boxes Buffalo Terre stations up to say 16 or 20 drives in a raid array and I deal with those all the time I deal with compact IBM perc controllers all of those things and I can get most of those jobs done but I will automate it if I can but there are many times I got to look at these things manually and see what they are X ways forensics also does raid arrays it has a couple of problems and I think there’s a bug some my epic calls the phone and tell them about it but so raid arrays there is one piece of software from runtime that called Captain Nemo Captain Nemo is actually kind of I don’t know it’s kind of crappy actually I’m not very thrilled with it but runtime software makes an automatic tool called raid Reconstructor it is the only program that actually tries to use entropy and try to do a calculation to guess it actually does a lot of work for that to happen so anybody use raid Rica charter yep and you have had bad results and I’m going to tell you why you have bad results I’m going to show you why a lot of times their software actually works and they don’t tell you it works they give you a little box and it says yes the result is not significant click this button and then it will say for $300 or whatever we will tell you what the right parameters are if you use our rate probe right you know talking about I will show you that it actually works the only problem is is that for some reason they don’t bother to tell anybody that when it actually works I’ve had some discussions with them about this and I don’t know maybe they’re making money doing raid probe I don’t what is it Oh reclaim me yeah I’ve seen yeah it’s reclaimed me so that’s a yes okay awesome that one is a good application so reclaim me so keep that keep that in mind as well as you’re going through this I’m going to go through the manual process of what it would look like this is like counting before the calculator and so I’m gonna I’m gonna go through real quick raid 0 raid 5 then we’re gonna do raid 5 and then you’ll do raid 0 on your own and you’ll see how quick and easy it is because if you did raid 0 you would be amazed at how easy it actually is in most cases so so really what we’re talking about is what is not a raid what is what is raid what is not a raid because you’ll get a whole bunch of these little mass boxes and that content out there a raid normally and you’ll see both variations of this there’s a redundant array of inexpensive or independent drives I think originally it was supposed to be inexpensive and somebody turned in the bill to the boss and the boss said that’s not inexpensive where’s the inexpensive part so they renamed it independent so that’s what people tend to refer to it today but I hear both variations some raids are not redundant and they were derived for different purposes and then there’s a number of different drives depending on which raid array you select I only really care about raid 0 raid 5 if we’re talking about raid 5 e double es we have all kinds of other things that take into place and it’s a lot more expensive but most of the other pieces of software that are complex will handle those jbods there’s somebody laughing really hard that they cuz j-bot stands for just a bunch of disks and somehow every box in the world says j-bot on it right just a bunch of disks and it’s just a term and it doesn’t even you know there’s somebody laughing a lot they’re like every time he walks with your three guys came up with that it says j-bot on the box so just a bunch of this so these disks are concatenated in most cases is like one drop becomes the first drive and the second drive becomes the extended drive so there’s a tool or a board or something that will then cause the last pointer from the last drive to point to the first sector the next drive so this is like this jockey as an example for those who have brought that up before you can take on the fly two drives connected to a disk jockey and it will make a larger array so if you have two two terabytes you can make four terabyte drive that will work temporarily for you while you’re doing this does the forensic person do that too because the lower inversion does it this forensic version do that the j-bot on the flop so so it is possible to do a variety of things with a j-bot from that now a common use of these has been lossy right well let’s see is promiscuous there’s only I like to say it let’s see who got acquired like a few days ago or something who acquired them anybody remember it just happened like Lissy just got bought by like Seagate or something I think it ca alright let’s see we’ll see you got bought by somebody though sigue bought let’s see I don’t know why but they did I mean it’s yes it because it’ll see was just mine maybe they wanted them to sell so I don’t know anyway they just and they’re just happened so anyway let’s see is our real problem right because let’s see make scrappy power supplies their power supplies blow all the time and they take a drive with it or take a board with it and their boards they make a whole bunch of unique boards and on any day they might release like three drives that are completely different they look the same it’s ridiculous with different boards and so we collect these boards and so I have like a mock so like a hundred of these boards that are all different kinds and so it’s a lot easier if I could just clone the drive on a ditch bar plug the tube back into a working board and plug it back into our spar over the line I’m done we do yes yeah if you can get it running again or anything with the original board so that’s a that’s a good trick to do and then I do it sometimes in software but if I I keep a stack of boards too that are working boards in the stack of good power supplies so if I can do it automatically great but if sometimes have to manually do it and they change their method from one to another like one day they will have a boards it’s a Linux embedded and they will use a 256 K stripe and another day they’ll use a 64 K stripe I see all different kinds of things on the C’s I’ve seen 64 128 256 and 512 K stripes I’ve seen a variety of messes so they look like this you open up the case you get two drives with a crusty old wire in between because they didn’t use a fan and there’s no fan in here and it’s a yellow and your Mac source is whatever so in some cases you’ll get some that are raid zero and some of them will be jbods some of them will actually just be connected from one to the first I have seen a scenario where an HPA you know this HPA where we say I’ve got a 200 gig drive let’s make it a 40 gig drive on the first disk they said the HPA to twice the size of the first drive so if both of these are 500 gigs they set the HPA to one terabyte on the first drive then the board concatenates the last one or changes the addressing mode for the sector’s so that all of these sectors then are added so it can catenate the two drives together so as you talk to the drive it keeps on writing so all your day don’t be here till you get here so it just fills them up in order they’re not rated if you get this in for recovery how can you tell which one’s the first one huh that was most data but MBR the MBR will be there on the first job in almost every raid array you can almost always tell which one’s the first drive because it has an MBR and in this case it also has an HPA the second drive will not have an HPA so when you clone this on the deeps bar if you took the first drive out and you look at it and go that’s crazy that’s not a one terabyte this gets obviously a 500 gig drive not on one terabyte you have to manually set the HPA equal to the source so you have to type in the number and so you could clone it set the HPA to the same save it put it back in place and you can get it to work again in its original case in the original box you don’t need to you can just concatenate the two drives together and you’re fine or image them concatenate the two files together as long as you have no additional LBAs and you’re not missing any it’ll actually work but that’s what actually happens now if one’s platter dust let’s say the first one is platter dust and it has really damaged what can I do to the second one to get data back carve that is all I can do because they do not have any file system information so all I can do is carve files then spit them out so I will not get directory structures and also other crap or whatever else all I’ll get is whatever pictures and stuff is on there that I can recover so a j-bot at least from this standpoint there are single drives you’re going to process them as single drives you don’t want to process this this as a single Drive if the other drive lived because you want to concatenate them or put them back together and amazingly enough if you actually take these and I don’t know why this works exactly from a standpoint of I don’t know if maxi this is a soft raid or whatever happens but if you took a Power PC or something and you plug the two drives in the max will actually concatenate the drives back together for you it will actually see it as one solid drive and it will actually do it if you’re able to repair it so even if this system died a PowerPC if you plug those two into it it will concatenate them back and show it as one solid J Bob one solid drive so there’s a number ways to do that now if you’re doing it in you can just physically actually copy the two files together once you’ve actually recovered them or concatenated them once so that’s not really a raid and it’s not anything special you know you can actually do copy B copy slash B if you wanted to but I could use two a hex editor and paste through the two files together as well so I can do either with either method in that direction but a copy /b does it in binary and you can copy one file to the other file and as long as you’ve got enough disk space it will append them yeah yeah so I can know I take an image of the first drop and to make a DD image I take a DA image of the second Drive and then I can catenate the tooth either in a hex editor or at copy /b or find a file joiner and just concatenate the two together that’s all I’m doing nothing special Yeah right it’s the same thing yeah yeah just copy slash be because copy does it with the Beinecke slash with a binary instead of text so the second thing that I’ve seen is the NASS boxes this is a laziness box now this is actually a raid 0 you’re now you can do this in software you could reassemble this in software in a raid array but I’m just going to show you one of the things that I do this is actually a real one running these were to 500 gig drives that we’re here this is an embedded Linux board right here this is embedded Linux running on a card with the processor and everything and this is an ass box I took out the 500 gig drive is damaged and I imaged it on the deeps bar and I got it to work all but a handful of sectors and I got it to a completely image and be fine but at this time I could not set the drive up to the same size I could not use the same size drive so I couldn’t do to five hundreds so this one’s a terabyte that’s why it’s actually called Terra so this one’s a terabyte drive and this one is a 500 drive so the drama took out was actually a 500 after I cloned this I set the HPA to 500 gig and when I put it back in Linux honored the HPA and still treated them as a raids it because of the raid zero it still treated them as it was a working drive so I didn’t have to do any additional work or anything I cloned it it worked I set the HPA I threw it back in the box I powered up the Nass and it worked now I can and have had them not work and when they do not work then after I cloned it I take two DV images then I’m feeding them into our studio and I put it together now if it’s only two drives you can figure out what the stripe says is and you can figure this out pretty quickly and we’ll talk about that when we get to raid zero but it was a raid zero good everybody happy with this answer so far and forgive the nice pitcher dynamic disk dynamic discs are fairly easy to do in our studio our studio actually knows that they’re dynamic this and actually knows the configuration I will tell you how many disks belong to it I made a short movie and I put it up on YouTube so if you just go to my the earlier list where I put the YouTube stuff up and my my HTML document some for updates you can just watch this 10 minute movie and you can just see how to do it but if you it’ll just tell you what just you got to plug in and so our studios will actually tell you which tests belong in the set all you have to do is plug all your distant once you’ve prepared them and you’ll be able to recover the dynamic discs so again I don’t want to spend too much time on that so we have raid 0 raid 1 we should really never be seen right raid 1 yeah as long as that drive was working now if you get a red one in then you only recover into one drive or the one set of drives because if it’s 2 combinations or mirrored then you’re only dealing with it as if it was a single entity so you shouldn’t see raid 1 technically you do because everybody makes crappy stuff out there but you’re recovering it as a single entity whether a raid 5 or whatever the combination is it’s using so we have raid 0 and then we have raid 5 and all the variations of raid 5 which are 5e and 5 ee and then raid 6 and raid 6 I use raid 6 and raid 6 is supported in studio so when you rebuild your raid array you can use our Studios for our raid 6 the plan would be to never see a raid 6 because whatever the redundancy factors were in raid 5 that were weakened failed are fixed in raid 6 because raid 6 has an additional disk and it’s not a parity disk people say that kind of crap all the time it’s not an actual parity disk it’s to this that have distributed parity across all of the drives and so there is an additional one in case there is an additional failure in raid 6 so we’re gonna talk about raid 5 and then raid 6 just has one additional disk it’s not a hot swap it’s not a I mean it’s not a hot spare it’s a additional disk with additional parity that’s actually live during the process of using this disk to increase redundancy okay so raid 0 why did raid 0 yes yeah you can lose so so you can lose 2 drives in raid 6 and still not have any data loss once you learn as the other drive now you’ve actually got a more significant problem so then you’ve got to fix it or repair it that’s why you’re seeing it so in raid 6 you can lose 2 in raid 5 you can lose 1 once you lost the second one then the second ones down and so we’re going to talk about rate five minimum disks and stuff like that but so typically in raid 6 you can have one additional discs so raid 5 the minimum number of disks is is 3 it’s 3 the minimum number disk is 3 raid 5 has 3 to write minimum or a 5 is 3 days and then raid 6 would have 4 so that’s the minimum number of disks so you can lose up to 2 in raid 6 and you can lose up to 1 in raid 5 once you’ve lost the second one now it’s in for recovery so we’re going to talk about those things now and what the orders and those things are raid 0 why was raid 0 was what is the point of raid 0 why would people be using it speed so a lot of video companies SGI’s used them for our video work and things like that their speed because you have two sets of parallel working together writing data at the same time so they’re great for video editing and things like that but they really I guess weren’t meant to be permanent storage and some people do them I’ve had a 14 disk raid 0 in for recovery 14 this raid 0 that’s just crazy talk that’s ridiculous who would do that I am amazed by the the people in it what’s the minimum number of dissing raid zero what’s the maximum number of dissing raid zero may know the maximum it’s a crazy number it’s way up there like I’ve seen them up I’ve seen them up too it’s pretty much whatever your controller supports but up to 127 or 128 because they start at 0 up to 127 or 128 I I think 45 is the one I’ve seen the most I’ve seen 45 in a raid 0 no there they were it wasn’t it’s like they keep a pendant they kept appending like the whole external stack of bells or what you say this is like that floppy thing where the guy built a raid array at a 27-foot no this was actually a real they just kept stacking them on and on a dell controller everyone tomorrow you’ll see it take a crazy picture and publish it yeah mmm good so and then the minimum number a dish you would expect to see in a raid 0 2 right so there is no we’re done now all right you’re gonna have to forgive me for this if I offend anybody but in my world raid zero should never be called raid 0 there is no redundancy it really shouldn’t be called a redundant array right so I think it should be called aids it’s an array of independent drives that suck that’s my opinion so if you have raid 0 you have 8 it’s terrible so you do not sorry and I tried to be funny and it’s not really a funny topic but you know it’s so anyway so raid zero is not redundant raid zero is basically distributing your slices across and so we’re going to talk about this have better pictures coming up so we’re going to distribute this across the disk and we’re going to use a slice size so when I write a file I’m only writing let’s say I’d say 64 K as I write 64 K I write the next 64 K here and then 64 K here and then 64 K here and I rotate through them and so as I’ve already said with a you know and I have had raid arrays it’s common for me to have a raid array that’s a raid 0 that has four drives in it and also a s 400s I’ve mentioned this before like s4 hundreds have four drives by default in and asked for hundred and they are raid 0 in and as/400 and so if you ever had to recover them the they’re not a standard 512 K sector they are 522 K s 400 is a IBM mini mainframe and so I actually have had those in for recovery as well but you won’t be able to recover those you’ll actually have to use Linux to recover them and you will not be able to use a write blocker because they’re expecting a 512 byte sector and not a 522 byte sector so they’re 522 bites not 512 and so you the last 10 or ECC and you have to strip off that ECC so you have to like write a script or a program to strip off the last 10 bytes and then you actually have your data and then you can weave them back together so you actually have to do some work to do an as400 so if you hear a is 400 either run screaming or get out some get a higher programmer come on over but it is possible depending on distributed items with 4 drives if you don’t know the combination you get the mystery box which is I don’t know what the order is I don’t know what the stripes are I don’t know what it is then it is possible that you could spend a lot of time trying to figure it out however if you use some of your wits you might be able to figure out how to eliminate some of the options so as an example how do you know which drive is the first drive probably has an MBR on it at least still today so things like that can eliminate one of the options now you know which ones first then you can actually work through your process and all the other drives so you probably have an MBR and then you have to deal with your size sizes so I try to point out what my examples these are redundant from this so here’s my point I’m gonna basically try to look at and and I just kind of came up with this by looking at the pictures remember that puzzle this is how it really came up with it you know those puzzles as a kid they were a little square puzzle and yet the little squares and you slide them around when I saw the way rade works and I saw how this slices work that’s exactly what it reminded me of it reminded me of these puzzle pieces I’ve got to move these squares around and figure out what the arrangement is so you’ll see in a minute now raid0 is much simpler so raid0 you eliminate one of the combinations all together so you only have slight sizes and order because the only two things you have to worry about so if you don’t know anything about the disks most of them are going to be 2 or 4 drives of course if you have 16 or 18 or 20 drives you better hope somebody at least wrote a number on it or you’re gonna be spending a month doing it but we’ll talk about it and then the other thing I do is I test to find the slight sizes I actually start looking at pictures in between all the sizes now this is not perfect and I’ll tell you why it’s not perfect in between each one of the segments let’s say I let’s say I looked at a picture and the picture was 64 K between 64 K in size and 128 K in size you have fragmentation you have things that may be wrong you may have corruption you may have other things that actually happen so I need to take a big sample I want to take a sample of like 200 pictures and looking like 20 or 40 of them and when you get some of the bigger ones if any of them are right you are probably right but you may have smaller ones or compressed ones or things that are embedded in other pictures and documents that fit in between here so small ones aren’t going to give you a good enough sample so you may have some that are right in my process so I’ll try to show you a picture pictures and try to kind of give you an idea like how do you know when things are wrong now I showed this in one class and I said what’s wrong with this and somebody said nothing so what is wrong with this what it’s like this radare you can write the body is missing but the body you don’t see any additional part four pieces in there what’s wrong with it exactly one of the drives is missing so you get now here’s the story well honest to god I’m not kidding somebody sends in a drive and it’s in for recovery and I am able to you know recover it and do whatever and I got it imaged on the DS farm then I start looking at it and I look at that and I’m going what that this looks like a Raider ring so I called the dude and he says yeah I only sent you the drive that I knew is working because I know you charge per the drive so I didn’t need any other data from the other Drive what are you kidding me so yeah so that’s what happened so you can tell things right away this is a raid zero it’s missing one of the drives what’s the scent in this one like so you know and my question to when you’re looking at this you have something wrong in one of the orders because these are two legitimate pictures from a Windows machine so I’ve got something that’s either wrong in my slice eyes or something that’s wrong in my disk order depending on what I’m actually dealing with but they are real and so at least I know that I actually have something what is my potential slice size in this picture if it’s about 140 K what would my slice size probably be 64 K and so if you can kind of guess from what they just said like if you’re looking at the picture and you look at about half of it then you can see the other half so I’ve actually got something that’s out of order either I’ve got my orientation or one of the other items is out of order in the raid and then I have small files like under 32 K these smiles are fine so I know at least my slice size is bigger than this because these picture are intact or if I had dozens of them that were intact then add small ones under 64k in this raid array and this would actually be something closer to a thumbnail but then when I actually found the real picture and looked at it it was like this now and I do want to point out even though that there is a problem with this if you look at this see how this strike across the top is correct I mean even if this was three drives and I was looking at a picture that I have extracted see how the stripe across the top is correct this starts to become a consistent pattern that you start to see and I’ll show you why in just a second like this one like even if this was wrong and there’s something wrong with this content right off the raid array and it processed it and there may just be garbage in this place but it’s like holding it as a placeholder because that’s what JPEGs and stuff view is it still processes it and you can throw crap in there it’ll still process the data let’s see how the striped across the top is correct so this is a pretty big indicator to me when I’m actually looking at content that I may have something that’s partially right but maybe I have one of the orientations and one of the rows wrong but I probably have all the drives in the right order so I’ll show you what we mean and then RAW files when you have large RAW files on a drive or disk you’ll actually get and this is a fairly large file this is a mini Meg file at this point so in these stripe sizes they look like little checker boards all over when you get things wrong so the whole point is is you’ve got to reassemble these things in the correct order even if you don’t know what they are and so and then when you get it right it looks like this but I want to give you a sample because you can also do a similar thing with mp3s and mp3s have some variations I want to play you a song hangouts like it all right listen to this and tell me this is all for real radar a so but so now I want you to also know like certain things that happen with like mp3 files because there are some things you can do like variable bitrate compression right so your slice size may be dependent on how much sound is actually in that like the segments from Aerosmith is longer than the segment so so the more dense the noise is the more the data you actually have in a smaller area so have smaller segments that you’re actually listening to so quieter and piano music will be longer than what you’ll actually hear for other things in the segment with the density if they’re using variable bit rates and things like that so so sometimes we actually listen to music or something else if we can’t find something I will tell you that movie studios normally use Targa files instead of JPEGs so you’ll be looking for target files so sometimes you need to like figure out what it is you’re looking for but movies will also do the same thing if you took them to movies and as long as the header was there and the command the codecs were the same you could take two segments and glue them together and they’ll play and so you’ll actually you know you can be watching a family guy and all of a sudden you’ll see you know Seth MacFarlane talking or something you’ll see two segments that don’t belong together so it can happen and so that’s one of the things that happens with some of these so so now I’m going to talk about rate five and then we’re gonna do raid five and read zero so raid five what is rate five four Snowdown no downtime is supposed to be enough for no downtime so that the server can keep running so someone can pull the drive out and put another drive in so if you’re at you know when it was designed the whole point was going to be my server crashes at least at least if it the hard drive crashes my server doesn’t crash I can keep my content running while I get another Drive but part of what’s happened now is so small businesses aren’t mine extra drives they don’t have them in stock small businesses are buying one little server with three or five drives in their raid array or whatever and they wait for a drive to die and then they call Dell and say I got one or something like that but if they don’t have a warranty or they’re not they don’t have them in stock then what happens is the IT guy he has the o fill out a little purchase order and he gives it to the guy bla bla bla and hopefully someday they’ll actually have drive but you’re gonna see it in for recovery in the meantime because the next rise is gonna die and they didn’t really put one in in time but the other thing that happens a lot is that when they put the sudden the new drive in there’s some other problem or something happens and two drives died around the same time yes it’s a very popular problem so when you’re dealing with raid 5 there’s two types of controllers in raid 5 it is very popular to have one off on your motherboard or one on your host base controller and there is in servers and stuff they normally would have what’s called a discrete controller the discrete controller will have a CPU that’s the difference between the discrete controller and a host-based controller so the street controller has its own processor and it’s going to be able to handle the math that’s necessary to keep the raid array running much more efficiently the host based controller is using your CPU and so when a drive dies there’s a lot of weight put on your local CPU to keep the calculations done for the data to exist the data does not exist without the all the drives actually existing at the same time so it’s a lot heavier on the system on a host-based controller so you’re we’re going to do some software in a rate controller but I’m going to show you an animation that at least makes this a little bit more exciting I used to use this when I needed to sell server or something like that to the client and I said this is going to be your solution okay so this is my my early animations of how a raid array works and I will tell you I wrote this for executives so most executives do not know what exclusive-or meant so when I put exclusive-or and I put like XOR in there for the exclusive-or routine because that’s actually what happens this drives exclusive or their parity they had no clue what I said but if I said a plus B equals C they knew that they knew what that meant right everybody had this finance class or whatever else and they could figure out a plus B equals C so I replaced it with a plus B equals C so here you go so you know that alarm that you just heard there is an alarm on most rate controllers everybody heard that the alarm on the raid controllers well it’s either in server room and nobody hears but in a small business it’s usually like in the closet right outside the CEOs office yes he says shut the noise off he walks through he’s like what the hell’s going on shut that off I work to do and then what happens after you shut it off hey what nobody does nothing yeah no urgency is gone and then the CEO says oh all right we’ll put in a purchase order for that extra hard drive that you need get around to it well I’m not sure it’s in the budget I’m not sure we have enough money to buy that extra scuzzy hard drive that you asked for so that’s really what happens they have no clue and then like six months later that’s when goes so right now it’s running but as soon as that one goes now you got a bigger problem and then that’s when we see it for recovery and of course the server’s down and nobody’s doing any work and then the IT guy gets fired like it was his fault he gets fired so he’s like you did not explain the urgency to me so you are fired or he just quits you like I’m out of here the server’s down you know there’s some statistic that like a small business that 92 percent or something of small businesses that suffer a major loss like this that don’t get it recovered go out of business within one year or something from a major loss you’re gonna be out of business anyway yeah right they’ve got enough money to pay for it yeah I don’t care how much it is I’ve got to get it back so so now here’s another problem when the second drive goes you know because the idea is you can throw an X on any one of these drives and so the segment is going to be a a a and then you’ll see parity for a so it’s it’s exclusive or so a exclusive art would be exclusive art with C exclusive or with whatever gives you your parity so if you ran if you took this calculation and you did the opposite and you actually wanted to say which segment worked you should be able to do an exclusive or in reverse and you should be able to figure out which drives are in which order because all you have to do is do that math every time you move it around and so believe it or not I actually asked run-time to do that and they made a utility inside of raid Reconstructor that does it they added an exclusive or routine of course they didn’t tell anybody how to use it that was awesome but they did at it I said like because they’re doing entropy and I’m like well you know there is a way to tell and it’s exclusive or anyway we’ll talk about that but here’s the real problem second Drive goes this one’s dead which one do you need to recover guys you need to recover the last one that died you know the most recent failure because this one was in sync the day that it died but now it’s the way out of thing this is six months later so this one’s the one how do you know which drive you get a box and you got four groves in the box and maybe it lucky maybe they put zero one two three four who knows but yeah I’ll know which one it is no because who knew which one the fired IT guy he’s the guy who knew and so and maybe the janitor the janitor actually might know because the janitor he’s mopping the floor and he goes oh there’s a red blinky light that wasn’t there last week he might actually know so I’ve asked before he actually does so like oh yeah sorry blinking like six months ago well that was Terry blinking yesterday it’s cool I like blinky right so you have to recover the last Drive that failed that’s it that’s the one you got to recover none of the others are going to be useful so that’s what we’re going to do is we’re going to focus on those now the rest of time you’re getting the mystery box it’s exclusive or routine so H this Lauren would be equals C so that’s what happens in a 3dr array but here’s your options for the things that you don’t have you don’t know your disk order you don’t know your slice size and then there’s a option for what’s called the arrangements and we’re going to talk about those in a minute for Windows uses stupid names forward backward dynamic but Linux has real names and so luckily our studio uses the real names runtime Reconstructor or raid Reconstructor uses the stupid windows names and they’re just dumb and then you don’t know much you’re fragmentation and that might cause a problem so bla bla bla so we’re going to do it that’s all the words I use to back that up so this is the arrangements this is what the Linux world primarily uses for names for all of the content so I want you to see remember the puzzle picture I was talking about where it could slide the squares around and I could figure out what the arrangements were look at these arrangements so if you were looking at a picture that came off of these drives and it came from this it fit so this is drive 0 drive one drive to blah blah blah but this is now think of it as a picture this is that square I’m looking at that segment let’s say it’s 64 okay and I’m looking at that segment this top row is going to be right if you have the direct disc order if all of your drives if you put them all back together and you’re not dependent upon the parity slice and you have those drives in the right order this top row the picture will actually be in order now the second row the pitch will be in order to you get to approximately where parity is obviously and let’s unless you’re dependent upon that you’re using an application that calculates that but I want you to look at the next one this one’s called left asynchronous the next one is called left synchronous you see the top row it is the same the layout is the same between those two one two three see that that’s that slice that cost the top that would be right now the second row is not right if you look they’re different four or five six and then rotates to seven and remember there was one of the pictures they had like a little blemish that was over here on the right later on in the lower row it was then one of the earlier pictures I showed it was this blue stripe crossed top and had a blemish right here so that’s where this parody it hit that spot in that parody so the row was actually right then it corrected itself and it was parody and then the next rows were wrong okay if you’re looking at this so if you look at the other rows they will cycle back through so once you get to the bottom of the cycle they actually cycle back to so on four drives that will actually cycle back through every four time so your slice will repeat over and over so you’ll have a stripe that’s good the problem will be is it as the data shifts and the JPEG calculations are doing something with that you might not have the colors right so you might still see the stripe correct but the color won’t be right because it now has a the wrong color tone for the stuff prior to it does that make sense so when you’re looking at this and you go back and forth between them and you’ll actually see that those two have variations that will cause that problem now here’s the other thing the next two there’s one called right asynchronous and there’s one called right synchronous so all those things that you were scared of with all those variations there are four of these variations but you will not see right synchronous or right asynchronous in any of the controllers I have never seen them in any of the controllers unless they were a 5a or a five EE so if somebody said have a compact raid array or I have HP or I have a I be M RAID controller now you’re looking at 5e and double e and those are right arrays and so they’re not going to be in any of the nasty oxes and they are not going to be in any of the llowing controllers they’re not in high point you’re not in Adaptec they’re not in ami they’re not in any of the low-end controllers that are like sub $1000 so you won’t see them at all so I can almost completely say if somebody did not say I had perc I know perks are not even those perks are actually still synchronization right left synchronous there’s no rights so at least from that standpoint if you’re not talking about IBM for any of those others they’re going to be left so you can take two options right off the table so some of the things you know right now you know which ones the first drive in they are you know it’s only going to be two options for the two either left or right the let there’s no rights you’re only gonna have two options for left’s and then you have options for your slight size so when you’re looking at your options for your life your size size you could have an 8k all the way up to a 2 mm k2 so at this point in time you could have small slice up to a very large slice this is not common for you to have these many options in almost all of the controllers a lot of the low-end controllers not everyone like a perk has some crazy options that you can still do but if you know what your controller is if you even knew that you could look up what your options are so if you knew that you have a high point controller or something like that or adopt that controller then you know that you may be limited to 32 K to 512 so you could lemon ate those right away I will tell you almost every one of them that some IT guy did not mess with is probably 64 K almost always now the IT guy gets is you know I’m setting it up it would be cool to say K well then you’re gonna have to play with that if you have a Lacey it’s going to be 64 128 256 or 512 to be any of us if you have pretty much anything else most of the others are going to be 64 or 128 so if you stick with 64 is the base and you start with 64 then you can figure it out as you go through between those things so almost always unless it says it’s little C then you have your choices are 64 K 128 K and then it will cease you have 256 and 512 as two more options for the sides so this is almost always then you have left so you have left asynchronous and left synchronous so you have those two options and you know which one is your first disc with your MBR right there are other things you can do to figure out the pictures and how big a picture is going to be so remember we talked about manual carving you have to know FFT 8 you can actually carve out a picture manually and you can figure out how big a picture is so when I told you before it was if I carved the picture out and it was wrong it will tell me the inappropriate size you can’t look at the size in the file system so as an example let’s take a picture and I cut it out let’s say it was corrupt on the driver I have my slice sizes wrong and I took that picture and I saved it you see the size of the dimensions that the metadata says this picture is that is not a cake that’s not an 8k picture right how big would that be 10 megapixel exactly right so I know you kind of maybe guessed a little bit is that about right no yes oh wait you like the pictures yeah so you can do that and you can try to guess or you have another option you go to the web and you don’t find the calculator for the for the size the physical dimensions and then based on the only thing that changes is what happens in between the JPEG with its compression now most of the cameras are using somewhere like between 90 and 95 or something around there we’re probably closer to about a 2 Meg picture so that’s probably what we’re looking at for that size of a picture so that makes sense so I’m looking at approximately 2 Meg’s if I answer and what those dimensions are knowing the camera and knowing the things that’s what I’m going to base my decisions on so I throw some drives in the array and I try to figure out what this is I’ve now fixed the draw it’s a fixed what I needed to do we’re still imaging a drive we’re still trying to fix what we’re going to put together now I’m gonna say this is 2 Meg’s and so like you guys look earlier you glance steady instead o is 64 K that’s what’s happening here too so the question is so if you break this down and you divide by 2 every time if you look at the top slice you can see that the second row is wrong and it’s the to shift but this top row is right even though there’s not really much color up there along the way and then it looped through again remember I said every cycle that’s going to loop through when it loops through watch this see how big see this slice is bigger than this slice that’s right in many cases that slice is bigger it’s twice the size understand look at the layouts I don’t know if it actually has a layout right here at the looks so remember I told you it would loop through depending on the drives actually since we have four drives there would only be five stripes before it would loop through in many cases so what will happen is it will loop back through it’ll go through this and this stripe will be right and then this stripe will be right and then that stripe will be but up against the other stripe that’s right in the same order so you have two stripes that will be back to back which accounts to the wider area and then it repeats itself and so when you’re looking at this picture huh yeah so when you start to see this now you start seeing color changes and shifts because JPEGs processing this stuff differently for its different algorithm stuff but do all of the items belong in this picture or all of these huh are they all part of this picture now it’s all shifted but see like this is the top of her head and then it shifts and then you got another shift and then you’ve got the finger and the hand and all this so so do I have discs in the right order yeah yes I do I have two discs in the right order because they’re actually slices like this then I have the disks in the right order how big is much life-size 64k right so we can tell it looks like 54k so the only other option is left in this picture that would be wrong is I’m dividing in my in space I’m dividing in so I said if this is two Meg’s then this is one Meg then this is five twelve then this is 250 set stand this is one count 64 I’m just dividing everything into visually that’s really what I’m doing based on the amount of size so I’m just trying to calculate what that slice might be if that was that wide you know if there’s a for Meg picture well then I’m at 128 and if it’s a 8 Meg pitcher than and so on and so on but you don’t know what that size the picture is without trying to calculate what that is because if it’s wrong like this is actually going to give me the true representation the file put it but it doesn’t always like when we’re wrong we need to know what the size of that picture is so we can figure out what our slice size is then so I would use the EXIF information from the from the picture if I can to prove that so I’m trying to use that data so and then so what would actually be wrong in this case is whatever the choice is for the two items that actually chose for left synchronous or left asynchronous are wrong and all you do is change that one so once you know you’ve got your order and you got those things instead of just keep going ah still make a list I still write it down on paper and I still say I tried this you know 1 2 3 64 K in this orientation and I still like mark them off until I’ve checked them off but I would only have like six variations or something that I could possibly do at this point to figure out if it was better or worse and so once I actually figured out which one it was and I switch from one of the asynchronous modes then I actually would get the picture right well this is actually three this one’s actually three drives but yes if it was the pictures so in these cases if there was three so so depending on those these are pictures from our studio these are pictures from a website so these are what what one is calls them and then so these are pictures from Warrick studio than their orientation so we’re gonna do it there on that are on the computer okay so what I want you to do is in the and it is typed up but let’s switch to the computer there’s two methods we want to use here raid Reconstructor and our studios i want to show you reagan Reconstructor first because raid we construct are supposed to do all this automatically now ufs explorer probably would do this all automatically and figure it out automatically but there are a lot of better tools than there used to be but i want to show you raid Reconstructor and what it’s supposed to do so start up raid Reconstructor what’s that what you say yeah but they’re in the raid5 directory so if you look there you will find and you can put them in any order but if you look and you click on the double dots the first thing is you’re gonna have to say we’re doing array 5 and I know I have three drives I’ve repaired the do all three drives I have all three running we can do it with two but I’m going to show you three it doesn’t matter whether we do it or two or not we just have a blank space so raid five and three drives that’s what I’ve sent you in the mail and then you click on the double dots and you go load all the images and so when you load the images they’re going to be in the same directory but there’s one called raid 5 raid 5 version 2 and you need to load the ones that are just DD so we’re going to do one at a time in each position each one of the DD images everybody okay everybody night okay once you have all three of them in the position if you did not have one of the disks if you repaired two of them and you had two of them and you didn’t have one of them it’s missing disk you just leave it blank you just leave one of them blank and it will be the missing disk so you don’t fill it in and it will treat doesn’t missing disk so you have to have at least two of them this one happens have all three and so we can try all those variations later but now you’re not supposed to have to know anything down here the theory is is that the tool is supposed to figure it out for you now windows raid arrays who use these stupid names backwards forwards bla bla bla who cares let just let it the whole point of raid Reconstructor is it tries to figure it out by entropy and guess correctly so just say open drives there is a button now that says step to analyze click analyze I don’t care what it says here click Next this is something that they added on in hopes that they could try to do like a sample of the drive just click Next so I never pay any attention to any of those things I just let them go because they never work ok so everybody should be at this screen now so as many people said raid Reconstructor does you’ve not had a lot of luck with it it doesn’t work a lot I’ll show you when it doesn’t work and how we can fix it so the thing is they should have checked all these boxes for us they didn’t but you should check all those boxes because we don’t know what the slice size is so you’ll notice it 16 sectors is 8k up to 1.8 now I will tell you right now if you have a Lacey Drive and you see the words Lacey add 256 and 512 because you would have to do that if you had to add 256 it’s actually 512 sectors and then 512 was actually 1024 because it’s times 2 right so if you had a Lacey Drive you should add this let’s see yes you would have to if you had a low seat because it’s let’s see if we can get our data back so you would have to add the 256 and the 512 because they have both variations now for some reason this standard policy seems to be 256 lately the ones I’ve been getting are 256 so what you’re getting you guys getting 256 lately I don’t I don’t know why it’s dumb way to do it alright so after you’ve checked these things just say next that’s all you need to do so this is how they were supposed to run and you see it failed and when you click this button huh yes what is that button say when you say it when you click it says click here for more it says please send us more money and we will do this rate probe thingy and we will give you you know we are answered tell you what configuration is for another 300 dollars or whatever it is blah blah blah if you do that rate per thing make charges all right so this is GS I’d complained about it but they don’t listen alright so make the screen make the thing as big as you can see like drag all these things so you can see what all your stuff is so make it as big as you can see like that everybody see that here’s what they don’t tell you they’re doing an entropy test and they use a key system for their entropy test and they made this crap up I don’t know what numbers they use or how they decided but they go in increments of 1 to 4 you know 8 or something like that when they have a high number when the number is greater than 6 or something like that they say success we know which the number is when they don’t then they just rate wherever they are at this point in time so you’ll see in this column right here it says OS : 4 that’s their entropy count the higher the number the better you are so if it didn’t match anything when they did an entropy test we have nothing the entropy did not work it failed on the times that it actually worked and did something that says OS : 4 in this case and that number goes higher as it increments so when it finally gets high it will actually say success and it will turn green it won’t really work there are certain instances with entropy that their calculation can’t figure out what the derivative is for the area around it you can change these numbers all day long and it won’t get any higher it will never figure out what this rate array is and this is a real rate array this is a hardware raid array not a software raid array I actually took 8 gig drives I’ve made a hardware raid array and then I broke it and I made these images so this is a real Hardware raid array but if you knew that OS : something and the higher the number then you could examine the column and you could say what are my possible choices how many choices do I have in this entire list from top to bottom because it’s actually a longer list right there’s a scrollbar here but from top to bottom how many possible choices do I have to examine to there’s only two choices so let’s assume you knew nothing except the order of the drives you win right now there’s only two choices cos : 4 that’s their entropy counter yeah there’s only 2 right so there’s only 2 choices and one of them is 1 2 & 3 and the other one is 2 1 & 3 so if you did know the disk order and the guy was at least lucky enough to write a number on your disk of I pulled this one out first and I pulled this one out second you already know and you win but even if you didn’t know you only have two choices here that will work so you can pick either choice you want and check it and see if it works so let me show you how to do that like I’m just did you check all the oh yeah if you added other stuff to it then it like changes the okay I see yeah cuz it won’t match mine at that point okay sorry and then just yeah then do it again I just want to play the same pages right okay that’s all about the glue right okay so uh so if you pick one of these I’m gonna just pick the first one here then I’m gonna say finish now when it says finish he’ll now go to the next step which is step three and this is you have three choices you can save a virtual image so a virtual image is what I use the most and the reason I use a virtual image is I can use mix I can mismatch drop drives I can use physical drives and I can use image drives I don’t image the good ones most of the time most of the time I do not image the good ones how you fix the bad ones and then I image those and I have DD images and then if I have 16 drives in a row I’m hooking them up through any method I can USB physical drives rate or control or whatever I can do to connect them to the machine yeah every saw so if I got 14 drives in raid 0 array I’ve just got to keep throwing those things in there so I physically will continue to add those things till I have them so virtual images do not require me to make an image and they do not require me to spit out a physical disk virtual image makes a physical just a standard physical XML file pointing to all the data so I just saved this in the root of the drive and if you make the path wrong it won’t do it right so if you type C colon backslash file name dot VI m it has the V dot V I am virtual image file never a virtual image however the so make a file name C colon backslash dot B I am then the file name dot B I am and then you hit everybody okay with that idea like I actually named my files after my test like I know this was raid 5 I chose 64 and I’m doing 1 2 & 3 in the order so the previous choice that I made I make my file name according to that so that I always save 1 according to what I’ve did and then you hit copy and when you hit copy it’ll save the file I’m overriding it and if you do view you’ll see what it is the view shows you it’s an XML file and it just shows you your layout and shows you where they are and shows you blah blah blah so that’s what the virtual image file is there’s after you hit copy saved there’s one that says view so you hit copy you say yes you see this you can now try to mount blah blah blah or you can scan it so you can hit view and you can look at it and it’s just going to be a text file in the root of drop so certain drives no raid 0 almost never has like an indent into the drive but like maybe a per controller and a couple of the others might have them so you’ll have to look for the partition segment and where it starts and almost always I can figure out from where the partition segment starts how many sectors I am in to the drop and it will be the same all the way across all the drives so once you know like on a par controller if it’s 128 K and you can also sometimes google it and say oh I got a per controller I’ve got some other thing how far am i otherwise you open up a hex editor and you go scan for the beginning of your partition segment for the NTFS string and then you can figure out from there to the beginning to drop how many K you have you searched for NTFS and you search for that string and then you’ll actually know how far you are indented into the drive at that point in time so you will fit sit that fall all the way across but if you know what your controller is and you google it they’ll tell you what the segments or what that size is and so and those are the things that you FS Explorer is doing automatically for you they’re figuring out where that sector is and where that location is and I’ll show you in run time here how that actually is done because there’s a way to do that to maybe wait so that’s what the XML file looks at now after you’ve done this you’ll see it’s step four is highlighted now let me tell you about raid or runtime software’s stuff we know that we’re if we’re looking at NTFS which we don’t know right now right you don’t know what my raid control what my raid array is do you know what’s NTFS you have no idea what I’ve done it could be a Linux raid array you don’t know what I did so we can’t look at it in NTFS if we don’t know it’s in TFS if we do we might get something doesn’t work the one that they have that’s the most versatile is Captain Nemo Captain Nemo does Novell partitions windows partitions and Linux partitions but it does not do Mac they do not have an H F s program yet so you have your biggest chance of it working with Captain Nemo so if you click on Captain Nemo it will now pass your virtual file to Captain Nemo and it will open it with your virtual file and your images this is now my raid array reassembled now what you want to do is and this is going to take hunt-and-peck you would actually have to go look for a picture and see if the picture worked so you could go down and you could say is this right does this look right it’s under there are some pictures under administrator and then I think I put them under pictures or my documents and pictures or they’re my documents you go into my documents there’s folders they have pictures in it and so if you just go find one and click on it when it opens up then you can tell if it’s good or bad so raid Rica shortener did work even though it told you it didn’t in failed so it is possible to do it now this is a and what I’m also looking at is how big the picture is this picture is a three mega church not being right zero right it’s completely zero yeah three Meg picture if I did not get the radar a configure correctly it will not work okay come on so you think the one day it will show a directory structure but it may also be munched up it won’t look right you will be able to actually tell you can do that you can take a step back and do that other one and you will see that like certain things will happen like Francis the administrator folder will be empty and some other folder may not because the file records are now not in order so if you had it wrong you also see directory structure changes that will not match but it will show you one it will show you something it just won’t be right we’re going to see that in a minute everybody okay so organ you guys good over saying click now check all those notes and then I picked the first one what’s the one I’m on but if you want to pick the second one you’ll see it’s wrong yeah second one is wrong and that and that is true it’d be fine if it was wrong and say okay and then you can click captain email and then you’ll be on the right configuration great if you have the wrong configuration you probably got some sort of structure but it was screwed up on it yeah now you can go into documents and settings administrator and open up a pitcher under the My Documents folder and then you can see that it’s right and it actually works to our studio you cannot present that to our studio our studio has its own method but you can present it or use it in ufs explorer so UFO explorer they have a module that you can use this with so you can use the virtual image now there’s a different configuration for our studio but and we’re going to do our studio manually because this is doing some automation for you and so it’s still not like the pocket calculator versus doing it with a pencil so i’m going to show you the manual way so now one other thing so one other thing I’m going to tell you about now let’s end close if you just go back to the configuration we don’t need Captain Nemo open and everything you can see it works you can right-click save all the files but I want to show you one thing that’s not obvious at all inside of you’ve probably looked at raid Reconstructor many times have you looked on the Tools menu yes because it looked like it didn’t work but let me show you something that’s amazing the Tools menu see under the Tools menu look at your one of your tests if you had them right as I told you before a plus B equals C if we have it right we should be able to do an exclusive or test they just never told anybody how this works you know what else that you didn’t notice so far they did not tell you which drive was the first Drive even though they put them in the wrong order in the second choice if you knew which drive had the MBR on it wouldn’t you know which drive is the first drive why the hell did they not tell us that it’s there it is there but they don’t have any indicator for that there there is an indicator for it in their program they just don’t tell you that there so I would like for you to run the exclusive-or test click exclusive or then you get this window you see this and you have a button that says start click start what does it say Green is at the bottom pass if you have them wrong it will be fail it will be red when it doesn’t know what they are at all and it fails completely it will be ambiguous and it will be white but I want you I want you to see something that happens that you don’t even notice right away now at the bottom right now when I click on it it’s going through these number of sectors it’s actually calculating the exclusive-or for all of these sectors so it’s calculating all of these and all of them pass this is all this is a chunk this is a chunk this is a chunk this is a chunk this is thousands of sectors it passed these past and they’re green it knew it’s right when they exclude some more tests see this where you see this little box over here on the side that looks really crappy it has no scrollbar or anything like that hit click in that box and hit the HOME key or ctrl home control home look at that it knows the partition table it knows which drive is first it just didn’t bother to tell us that in the other screen well no just because all the drives are there and it’s comparing them it’s actually doing this automatically in this process if you it it’s not telling you the order but it’s comparing these gluts of all patterns to make sure that they’re correct it figures out the order on its own I know I know what you’re saying the tool actually does it for you it is figuring that out it’s not all it’s doing is doing that exclusive or calculation and it is figuring out that on its own in order for you to cause it to fail on this array you’re actually going to have to like change the drives you’re gonna have to like throw a dummy drives in there it is an exclusive or pattern for these in this order it is it is doing this automatically for you it is calculating these on in these exclusive or yes so humans just one second and with just tuned that one you can see this a 5/5 – yes yes yes if the MBR was on the second disc it will tell you which one is the first one yes it will actually figure out that there’s at least enough for the parody to be able to be calculated so it will do that so it actually has to be actually wrong like we’d actually have to like not have the content in this case so we’re just trying to figure them out and do an exclusive war test so you can see it when you have completely wrong stuff in there it’ll completely be red or to be ambiguous then we’ll show up but my point was is that there actually is some rudimentary test here it’s not that we still don’t get to do any work but it will it will at least tell us that it’s actually doing a calculation and it’s figured this out so and if you have all the correct drives in there it does this on its own without our consent basically it’ll try to figure it out and tell us but they don’t give us the answer so we have to actually physically like go look at it well the parody once they’re in the right order with a missing disc it will work it’ll actually work like so just to give you an idea I’m going to I’m going to close these drives and here’s this one which actually has the actual information on it then I’m going to make it blank and so if I open drives and I do the analysis and of course this is probably wind demos fail that’s what all right let’s see you see this see this one has a missing disc there missing disc is missing this one but it knows that disc one was the one with the MBR in the entropy test this will actually work it’s missing a disc and I only have two discs it will work if I click this button I do the exact same thing copy yes okay view it will actually work with a missing disc and it will figure it out in this case the three driver is correct as long as one drive is missing it can still figure out at least the basics of the entropy test even if you have them one missing disc so it’s a five you have to have to to have the data and it’s recalculating the parity for the remaining drive for the remaining sectors for the remaining content so it is doing this and again it doesn’t work perfect every time but you with some struggle and with some knowledge that at least that was the layout you can actually try to figure it out and make more advances but there is still one thing which is our studios which is to do it manually so alright let’s go do our studio real quick just so everybody can get an idea here let’s close everything close everything all right okay all right ours quit in half a day yeah must be nice relaxing taking kick him back all right open our studio our studio is the ugliest interface ever especially doing raid arrays anybody done our way to ring in our studio yes all right so what we want to do first is we want to load our images into our studio so this is where you’re listed the discs are this is where the work is going to be done this is your log file so I’ll show you how to create this raid array they make you create a virtual raid array so go to Drive open image and you can open all three of the raid ones just by clicking on control so you can actually open each raid raw each raid file by clicking on the DD and holding down control so you go D D D D D and open those three everybody okay all right which one’s this one how about that now here’s your hard thing do not select the partition select the drive if you select a partition you’re throwing it off by 63 or 64 sectors actually you’ll be 64 s into this huh what does Oh it’s software yeah but you want to select your partition after you’ve combined your disk not before you combine them so that’s the first thing now so we have three we wouldn’t we know which one right away is this one is because of that we don’t know the other two but we so right away you see when you put all the disks into the image you know which one has the MBR on it because it tells you right so it’s already picking it up now we just have to make sure we do not select the partition because the partition would be 64 sectors into the drive from 0 to 63 and that would throw these off and then the two images combined would not be correct right so let’s just say I had a really big raid array and I had to do this manually and I had to figure this out which I have had to do with like Targa files for movie studios and things like that and the end times so what you have to do inside of our studios you have to create a virtual rate array and then populate it with this data so under create you will see a convert create virtual block raid click that create virtual block raid that’s how you make a raid 5 array so when you click this you will now get an additional image and it will say virtual audience and then you will say virtual block raid 1 everybody see that now the easiest way to populate this they do have a drag-and-drop interface but I don’t like it the white box is over here if you right-click it will show you all your devices make sure you select your images now here’s the thing our studios does not do it automatically for you you will manually have to figure out what the order is so it’s not like reg Reconstructor where they calculate it and try to give you an automatic idea you have to manually select it so you know your first drive is this one it says it right here do not select the partition select VDD image and when you do it will remove it from the list right so don’t do the partition do the drive then add the second one now if you did not know what order they are this is where our examination is going to come in and so and and I’ll tell you that our students will do it wrong by default so you will know right away will be wrong and you’ll have to figure it out so if you select number two and then number three now the other thing you want to do everybody’s here at this spot the next thing you want to do is this we know this is rate five you’ve been told this is a raid 5 raid this is not a raid zero so this is a raid five so select raid five now there’s one other thing does everybody see a button that says apply changes immediately this used to be a bug it used to be off the screen is this is it off the screen or can you see it check that box please anything that you change it will not take place if you do not have this button checked so check that button so that every time you make a change it does that change immediately now you can see in the list what our choices are we have raid 5 we’re currently at 64k and then here you have your 4 choices that I’ve talked about earlier which would be your left standard sinkers left asynchronous you’re right synchronous and right asynchronous so the default ones you’d want to start with would be 64 K which I’ve already told you is the majority of most of these raid arrays the second thing is I would leave it at the default which is the left synchronous because I know it’s going to be one of those two anyway it’s not going to be a rave or a right synchronous in this case because I did not tell you it’s an IBM controller or anything like that so then you’re gonna have an expensive drive and that’s a tape drive so at this point in time if I had a big raid array I need to know as quick as I can is this right so I want to scan for JPEGs I don’t want to waste all time all day processing and scanning all of these things for all these variations to see if it’s right or wrong I just want to see pictures and I want to see them fast so that make sense so we did do scanning earlier so see the partition that we now have right here in the virtual block raid on the left hand side it has created a virtual partition in one you see that so I want to scan for JPEGs only do that you guys remember how to do that right click until you have around 200 documents of our requested type so turn off all the ones you don’t need if you want it to be faster what’s that oh well then you won’t know so change your known file types you’ve got to clear all add graphics back and add just JPEGs cuz if this was a giant array it would take a long time and I know it’s not a giant array so it’ll go fairly quickly but if it was the whole point is to do this fast so you do just JPEGs you leave detail scan on and you click scan and now you’ll see that’s just going through the array you see down here in the bottom it starts calculating all the content as it’s going through it so you see us doing specific documents those are the ones we’re asking it to carve so it’s done 114 a document so we’ve asked it to carve down here it shows your where it’s going but uh well I don’t know for sure how accurate is because I don’t wait exactly perfect as soon as you know that you’ve got enough documents to look at we don’t need to wait for the end of the array if we had 50 terabyte here it would take us forever we only need a handful of these I know people who do this I swear to god this happens every time somebody sets up a raid array they start to scam program thinking that you know I will come back when it’s done and then we’ll see if we win if we don’t then we’ll change all the settings so at the end they’re like waiting a week and at the end of the week then they say awesome work I gotta try again if you only do JPEGs what’s that exactly that’s the point right so once you get enough I mean I’m way enough I got 2,000 and I’m still nowhere near the end the drive this still might take a while I mean imagine this is only a 16 gig or a during this is the only 16 get greater a B and if I wait even for this one it may take me a while so as soon as you know that you have enough documents you hit stop are you sure you want stuff yes I do now you have extra files found please look at those pictures and tell me if it’s right it is not correct but when you look at the pictures let’s just say I jump in there I pick some pictures now you do need to take a sample do not trust only a handful of files you need to check different things of different sizes the bigger the size the better you’ll probably be but some of them might not be viewable if they are wrong so if you pick one and you click on it it may crash corrupt whatever like this one like obviously it’s wrong as soon as you know you’re wrong you are wrong because if it’s right it’s either right or if it’s wrong then there’s some corruption or something else was happening but you can’t trust a small sample like small files depending on boundary and compression and things like that like I’m sorting by size small files may actually be okay like when I go to click on small files that one looks line if I go down here and click on some five K files and whatever that makes sense everybody okay you understand them while these small files are okay that one’s obviously not so I’m going to drop down here just some big files like it was at a few minutes ago so I’m down here I’m gonna pick a big file now look at this picture do I have all of my slices do I have all my drives or all my drives here yes yes all my drives are here do I have all my drives in the right order yeah yes you know that right away cuz the stripe at the top is right so if those are actually segments and this is one segment and this is two segments and this is three segments then I actually have it’s actually going to be right you’re actually gonna see that component as you’re looking at it the other thing is does all the content belong to this picture and actually as part of this picture right so I’m pretty close to actually being right what’s my slice size for this picture probably I think it was I mean I have to look at XF information know for sure but I think it’s like three mags or something according to this it’s like 2.5 Meg’s or so so it’s huh now I’d have to actually look at my XF information it will probably be right at this time but if it was a screwed-up Raider aim then did not have them in the right order this file size would be wrong it will actually physically be wrong so I’d have to extract me except for information and I have to look at now you can’t look at it in hex plus say I’m here you’ll notice where I can right click and I can save you and our Studios has its own hex tool in here and I can cut off cut out a chunk of this save it to my desktop and then see what my excess information says or calculate it from the type of camera blah blah blah right so everybody understand what I mean so in the picture there is EXIF information so I can highlight like we did earlier carving manually carving and I can just take a big chunk of this supposedly right thing and I can save this and so I can then export this I think there’s actually a save routine somewhere in here save to binary file hit that then I’m going on my desktop I’m gonna save this is actually a JPEG right so I’m gonna do test 1 for test 2 dot jpg and I save this and if I get a big enough chunk and I look at the desktop now I’ll actually be able to see whether or not I’ve got some chunk of a picture or whatever else see I started getting it across the top you start to see it I didn’t get a big enough chunk for it to be something really something I can tell very clearly but you can see it’s the top of the tree right top you see it if I save more I’ll get more what I don’t I generally feel like I can do better with the bigger picture than I do a smaller picture the smaller pictures aren’t going to be as accurate because compression fragmentation boundaries bigger pictures you know right away you’re wrong when you’re like in excess of like two mags or something like that you’re way beyond its light size right so now the other thing that you need is you need something actually looks at XF information to tell you whether or not I can see anything here so the number of free tools or something out there but if I look at this I believe my XF information if they haven’t changed it in this version if I go to my desktop I think I’m an illustrator my desktop where am i thank you see so Directory Opus is doing this function for me I could download another tool or whatever but see if you look at Directory Opus it parts the data from the EXIF information or you can use an XF viewer or whatever and I can take this and calculate this and type it in to a calculator figure out what it is and according to this this should be about a little bit bigger than a to make picture right everybody good even though it currently is not it currently is 14k it certainly isn’t a 14k file right everybody okay now so I’m back in our studios and I’m looking at this picture so I know I have my drives all my drawers and I know they’re in order and I know it’s a 2 Meg picture so how big is must life-size looking at this picture huh that’s what easy two minutes yeah I mean yeah there is but from what I’m looking at at least again from huh I’m looking at physically like this is two Meg’s and then half to be one Meg and then half would be and then half would be somewhere right around here and then but no look so this is a strike that’s wrong so even though this might you maybe you think it looks like it from there but see this is wrong right and then all right we are on 64 so my size is 64 so what’s my only other thing that’s left no what’s my only other listen I only have three options I can change right try that see if any of the other options work you can but I will tell you sometimes that’s buggy you if you really want to be sure you should probably clear the settings and do it again but it does go back but every once in a while it’s buggy and kind of freaks out so you can go back get rid of this and then I’m back to where I was on my virtual raid and then the only other thing I can do is change my options for this now if you’ve discovered that now it works your next job is in the directory above this one there’s a raid zero shouldn’t take you about five minutes to figure out raid 0 now raid zero so easy do those two in this application do a raid zero on your own there is raid zero files above this directory to do raid zero get it done on the on the hard drive there is now if you go look oops there is raid zero files up from here so if you go looking that data recovery directory there’s the raid zero and there are two image files in raid 0 reassemble like they are assembling the raid0 in the directory above those there’s a raid0 directory with two drops in a raid 0 array use our studios to reassemble raid zero on your own well made 0 becomes amazingly simple by comparison yeah and that’s a real raid 0 array from a hardware raid array it’s not pulled a lot of information but it’s still raid 0 it’s actually a that pit controller once you’re done that’s it that’s what I got for today so all sets are going to be any time that you’ve got something that’s at the beginning that’s indent that’s why I said the same thing all you gotta do is find the beginning of your partition and you’ll know where that sector is and that’s it well like some of them are standard like I think perc is a 128 who Dutton Martin do it in the morning or the morning tomorrow cuz tomorrow we have labs and stuff too so we can work on it tomorrow yes I did do that I do that a lot in raid arrays where I have like you know 16 drives in a raid array and I don’t want to have to go like shopping parts that it’s exactly what I do is I completely image that drive and then I can use that for parts if they are exact matches that’s correct I do dump a DVD to the disk that’s all I do is just make sure that I get a good copy of it and verify it before I take the first drive apart before I take it apart trying to get to our TVs yes that’s correct and in your case with promise controller yeah yes then that’s no problem ami ami Adaptec promise it just doesn’t do 5 e & 5 ee but you FS Explorer does like if I took 2 DD images and somebody told me a whole this or three of them are five of them by if I took those and somebody said oh well this came from a compact then I can throw that in you FS explorer and use the same thing use youth is just DD images still you just need a different program to process those or if it’s the MoMA Buffalo Terre station I cannot do it with X at least this is not support XFS so this will not do a buffalo terror station I have to use ufs explorer to do that you have no problem do it all the time someone that we well like I said there’s a couple other ways to do it which are actually look at it in hex and then break the segment’s down and then try to figure out from the space of the segments and that’s what the class from Hoffman Hoffman cuz Hoffman in the Netherlands they have a class where they actually have and they have a script they wrote you know I’m talking about Hoffman Hoffman’s investigation company they’re kind of like a PI firm or whatever you want to call it in the Netherlands and they actually have like other operations in other countries too but they teach a class on how to actually take the segment’s and then actually you know look for the segments and the break in the segment and the buffer in the segment from one segment to another and then calculate the space between the buffers to figure out if it’s 32 K or 64 K and our Studios wrote a similar white paper on it yeah and it’s yeah but it takes a lot of time doesn’t it right right right in this case usually in under 45 minutes I can look at a picture and I can figure out why my closer I’m not glows give it right yeah yeah I like this method most of Tom like I said it’s not perfect every time but the majority of the time I can do it and I’ve done this for like a movie studios and other stuff like that before they’ve done target files and the Machine died in the process writing these things out from an SGI machine and things like that and I’ve done hundreds at this point that are very similar most of the time on most of the lower end raid arrays no but from time to time you know like some of those that raid arrays that write a segment at the beginning that has a counter this says i’m dr 1 i am dr to i am dr 3 like a park controller does you have to set the offset to get past that so if you have a perk controller then you have to and it’s probably 128 this Mabi 128k and so you just set your segments for 128 K and that’s your offset and then the drive will show up all right okay look look at him are and try to figure it out their layouts or something our studio has it on the right hand side see that where it says offset inside yeah that yeah how do I know what it is yeah well you know what you’re doing in hex when you go and you look for your segment okay so you go down for your partition structure and you find the beginning of the MBR and your partition structure the count from there back in most cases is your number yeah so if it’s like a part controller you’ll see it at like 128 K into the drive but you like I said you can also maybe just Google or your controller if you know what it is then there will be a document somewhere that will tell you like you can actually find it in many cases that people have done it but if I want to look at it in hacks I can actually just highlight from the segment from the MBR yes to the beginning of the drive save it and they’ll say 64 K or 128 K so I just highlight the segment that I want just like I just did there when I was doing the picture like this says that it’s 14 K so if I had just highlighted this segment from beginning of the MBR back to the beginning of the first drive if I find the MBR because I have to have to find whatever the beginning my partition structure is so I’ve got a look at my drives fill up on the NTFS signature and then go back to the MBR and then go back from there so I just highlight from there to the game of the drive and save it and if it’s 64 K because it should be one of those boundaries it should not be some arbitrary weird thing it should be 64 128 or 256 or you know in some cases there are some that have like a well like configuration files like sometimes like Lacey URI makes a segment for their Linux configuration files and they write just like a 200 Meg partition at the beginning and store the data there and then they offset the second drive to that amount that’s what most you