To help with creating a forensic RAID image of an array with an unknown configuration, Atola TaskForce is now equipped with a RAID assembly, configuration autodetection and imaging capability.
What is currently supported:
More RAID types and file systems will be supported in upcoming releases.
Autodetection module starts running immediately upon the selection of the RAID devices (or images).
If you know the configuration, you can enter it manually.
Autodetection uses heuristic algorithms to help avoid tedious manual work while searching for:
Maximum allowed number of RAID parameter combinations to check is 100,000,000. With 12 possible block (stripe) sizes ranging from 512 bytes to 1 MB, the current limit enables TaskForce to check all possible RAID configurations for:
After you apply the suggested configuration with one click on a button, drives are arranged into the correct order, RAID type and other configurations are automatically applied, and file systems are searched for.
If you are reassembling RAID 5, and one of RAID 5 drives is missing or is heavily damaged, TaskForce allows you to select all available drives (or images thereof) and click Add missing device button underneath the list of drives and/or images.
TaskForce uses the redundancy inherent to RAID 5 to identify the configuration and create a full image of the RAID even in the absence of one of the RAID's parts.
When the Autodetection module parses the data on the drives to identify the RAID configration and encounters errors, error tags are displayed next to the respective RAID member. Despite the errors on drives, TaskForce is able to mount the partitions of the RAID for preview using data redundancy of this RAID.
Any change in RAID configuration you perform manually or by applying the suggestion produced by the Autodetection prompts the bottom Partitions panel to refresh. If the configuration is correct, file systems are found and validated, you see partitions and their contents.
TaskForce instantly identifies mdadm-created RAID arrays with great precision by detecting controller metadata. These types of arrays are mounted in a matter of seconds and do not require a manual selection or application.
TaskForce’s autodetection module is able to detect the Start LBA parameter for different types of mdadm RAID arrays.