Instant forensic RAID reconstruction: Linux mdadm
TaskForce can automatically detect configuration of software RAID created with mdadm in Linux and perform immediate forensic RAID reconstruction.
Autodetection of the mdadm-created software RAID
1. Connect the drives to ports in Source mode.
2. Click the RAID button in the left-side Task Menu.
3. Select the drives that make up a RAID array and click CONTINUE.
Autodetection module has instantly recognized and applied the RAID configuration. TaskForce automatically identifies mdadm-created RAID arrays with great precision by detecting controller metadata.
This RAID’s Start LBA is different from 0. TaskForce’s autodetection module is trained to detect this parameter for different types of RAID arrays and mdadm versions.
A partition is displayed in the bottom part of the screen, confirming that the applied configuration is correct.
Forensic RAID reconstruction
Imaging the mdadm-created RAID array
1. Click the GO TO IMAGE button to proceed with imaging the assembled RAID.
2. Select the target and click Continue.
3. Click the START button and confirm the overwriting of data on the target.
The imaging session runs as fast as the target speed allows.
The imaging report contains all the RAID details and timestamps.
Imaging report for an mdadm-created RAID
