pulling informaton from raid

[GunMonkey]

Alright, I have a bit of a hum-dinger (forgive the term) I'm with a team that needs to pull data off a computer with raid. The challenge:

1) One of the 9 drives was stolen
2) The server is running triple Pentium processors, has only ISA slots, no video card, and a strange scsi to ATA interface.
3) We were unable to discover if the network card is still working, as it is missing a link light, and the only OS we had available was vista.

I am going to be using backtrack tomorrow to play around with it, and I was wondering what tools I should focus on, or if anyone even thinks its worth the effort.

[Capital B]

What kind of RAID is it? If it were 5 or 6 you could just put a new drive in and rebuild/recalculate? 3 and 4 you should be able to do the same thing if it wasnt the dedicated parity drive stolen.

You probably know this already though, but just thought id mention it.

[GunMonkey]

Yup, I do know that much. However, we have no clue what raid level was used. They could be all mirrored, though that is pretty unlikely.

[streaker69]

If it's a RAID 5 and a drive is missing, then the system should still be bootable. You should just be able to get another drive of equal or greater size and drop in and rebuild the array, a hardware RAID controller will probably do that automatically when you plug it in. Hopefully you're not using a Software Array, as they tend to be a little more finickey.

[samsung]

Find out what raid your using, enter the raid bios either ctrl A or what ever controller your using, that'll tell you (you know this already...) & as all the other replys suggested, plugging in a different or new hard drive, should auto rebuild the array. When you boot up, does it give you an error like degraded array etc? You can usually get around this in the bios ;)

[s1lang]

Would Helix be better for your job over Backtrack mate??
Or as well as :)

[streaker69]

I would think if it's a 9 drive array, there should have been at least 1 Hotspare in place. And if there was, the array should have rebuilt itself to the hotspare when one drive went on walk-about. Unless there was already a dead drive and the hotspare was already in use.

[GunMonkey]

I think I'm in more trouble than that. What I thought was the raid controller... isn't. It would seem the scsi/raid controller is missing. I'm pretty sure its impossible to rebuild the data without the same exact card (at least brand).

I'm going to try to hunt up a scsi controller and check each drive, one at a time, just in case they weren't all part of the array.

Oh, and its an NEC 4200 RISC, if that helps any. From what little I've found, it was one of the first NEC machines with RISC architecture.

[streaker69]

I think I'm in more trouble than that. What I thought was the raid controller... isn't. It would seem the scsi/raid controller is missing. I'm pretty sure its impossible to rebuild the data without the same exact card (at least brand).

I'm going to try to hunt up a scsi controller and check each drive, one at a time, just in case they weren't all part of the array.

Oh, and its an NEC 4200 RISC, if that helps any. From what little I've found, it was one of the first NEC machines with RISC architecture.

Do you know what SOL means? Because that's pretty much what you are right now, if it is a real hardware RAID. Hopefully you have the data on Tape somewhere.

[Oneiroi]

I think I'm in more trouble than that. What I thought was the raid controller... isn't. It would seem the scsi/raid controller is missing. I'm pretty sure its impossible to rebuild the data without the same exact card (at least brand).

I'm going to try to hunt up a scsi controller and check each drive, one at a time, just in case they weren't all part of the array.

Oh, and its an NEC 4200 RISC, if that helps any. From what little I've found, it was one of the first NEC machines with RISC architecture.

The RAID data stripe-ing I have found to be standard across most hardare, i.e.

I was able to take a raid 1 array of 2 x 40GB IDE disks off a dead Promise SX6000 PCI raid card, and get the data by using an onboard adaptec raid controller.

I have even been able to get data from a Netgear SC101 doing this ... even though it uses a propriatry data format, as long as the machine with the raid controller has the drivers installed you can get at the data.

Anyway the best thing you could do is plug in a spare array controller, hook up the drives, and boot the machine, making sure you hit whatever key combination to enter the cards setup BIOS menu, navigate through whatever menus to see if the drives and thier configuration is detected.

A very square peg > round hole > Sledge hammer approach, but it could work.