Page 1 of 1

Intel Matrix Lvl 5 Raid w 4 discs

Posted: Thu Jul 15, 2010 8:38 am
by praktit
Hi, have managed to create images of the four drives. At the 2nd to last sector the drives in the array are identified with their serial number, so I guess the order of the discs is revealed there.

But when imaging, disc 0 had 16 bad sectors, and disc 1 had many more; disc 2 and disc 3 were intact. Most likely the array has been degraded for a longer time. Would this mean that I´m better off leaving out disc 1 as missing disk?

Also, does anyone know the block level layout of Intel Matrix raid?

/Peter

Re: Intel Matrix Lvl 5 Raid w 4 discs

Posted: Thu Jul 15, 2010 10:09 am
by Alt
praktit wrote: But when imaging, disc 0 had 16 bad sectors, and disc 1 had many more; disc 2 and disc 3 were intact. Most likely the array has been degraded for a longer time. Would this mean that I´m better off leaving out disc 1 as missing disk?
Yes, that looks so. I'd rather turned the disk off by un-checking it on the Parents panel. If necessary, it can be quickly turned on by checking it.
praktit wrote:Also, does anyone know the block level layout of Intel Matrix raid?
I'd try to reach the Intel support. Although usually that's useless.

Re: Intel Matrix Lvl 5 Raid w 4 discs

Posted: Thu Jul 15, 2010 6:44 pm
by praktit
Found the layout, it's left asynchronous. But since the raid-set is degraded, parity sectors are plain code.
Will see if a complete scan finds the mfts and complete files.

/peter

Re: Intel Matrix Lvl 5 Raid w 4 discs

Posted: Fri Jul 16, 2010 5:29 am
by praktit
Hmm, typical, after a days forensic work, I finally found the paper: http://www.intel.com/assets/pdf/appnote/310855.pdf

In any case, I've created identical physical discs, and on the 2nd to the last sector the raid config is written, as the disk serial nbr. A crazy idea :-) - I can't access the discs from r-studio, since they are reported as unknown by the matrix controller, but what if I edit the serial on disk, to match the copy serial nbr? - Problem is I can't access this directly, only through r-studio emergency, and there the hex editor is read only. How do I access the disk and edit this info?

cheers / peter

Re: Intel Matrix Lvl 5 Raid w 4 discs

Posted: Fri Jul 16, 2010 7:28 am
by Alt
I'd connect the disks to a common IDE/SATA controller.
R-Studio Emergency needs to be activated to be able to write data on disks.

Re: Intel Matrix Lvl 5 Raid w 4 discs

Posted: Fri Jul 16, 2010 11:47 am
by praktit
Ok, have faxed an order for the technician version, so I can try that, and hopefully recover files. The scan is now 41% (after 16 hours) into the raid-set, and have a few complaints about unexpected MFT records (most likely from the degraded parity blocks) - so it remains to see if we can get the most cruical parts out of the system. In the meantime when I get the license keys, I'll give the long shot a try.

/peter

Re: Intel Matrix Lvl 5 Raid w 4 discs

Posted: Fri Jul 16, 2010 1:47 pm
by praktit
Alt wrote:R-Studio Emergency needs to be activated to be able to write data on disks.
How? - I got my technician key, downloaded and created the TUI emergency version. I can only view the first sector, not scroll, not go to a sector, and certainly not edit anything on the disk - what am I doing wrong?

/peter

Re: Intel Matrix Lvl 5 Raid w 4 discs

Posted: Sat Jul 17, 2010 3:19 pm
by Alt
praktit wrote:
Alt wrote:R-Studio Emergency needs to be activated to be able to write data on disks.
How? - I got my technician key, downloaded and created the TUI emergency version. I can only view the first sector, not scroll, not go to a sector, and certainly not edit anything on the disk - what am I doing wrong?

/peter
Sorry, I don't realize you've got a Technician license. Why do you use the TUI? GUI is much more powerful. Actually, it's almost the same as the Windows version.