When imaging RAID 5 array with errors on multiple drives, Atola TaskForce is still able to detect its parameters and image the whole RAID. Let’s examine a case with a RAID 5 consisting of 5 drives, two of which have bad sectors.
Reassembling RAID 5 array with errors on multiple drives
Click the RAID button in the left-side taskbar and select the drives that make up the RAID array.
TaskForce autodetection module starts running immediately upon selection of the RAID members. In Stage 1, TaskForce reads data on the drives to identify the RAID type. In case it runs across an error, it displays an Error tag next to the corresponding RAID member.
To see the number of errors encountered during the media scan, simply hover your cursor over the Error tag.
TaskForce autodetection takes a few minutes to find the best parameters for the RAID. As soon as TaskForce detects the suitable configuration, click the Apply button.
TaskForce automatically applies the suggested configuration and checks the file system for partitions.
Despite the errors on the drives, Atola TaskForce can mount the partitions for preview. This is possible due to data redundancy inherent to the RAID 5 arrays.
Imaging RAID 5 with errors
To image the RAID, select the target device and start the imaging session.
Upon encountering an error, the system automatically reconstructs the missing data on the fly. TaskForce achieves this by using the parity blocks on the remaining RAID members. In the imaging speed graph below, you can see how imaging time dramatically increases when TaskForce encounters an error. The longer imaging time is due to TaskForce performing the reconstruction of data.
It is a fully automated process, no operator involvement is necessary. TaskForce seamlessly integrates the reconstructed data to create a complete image. And the image has no data missing.
What if …?
What if multiple drives of the RAID 5 array contain errors in the same (corresponding) sectors and data reconstruction is impossible?
In this case, TaskForce’s automated multi-pass imaging system works with RAID arrays just as well as with individual drives. If data in certain sectors is unreadable during the first pass, the multi-pass imaging system will address the same sectors on subsequent passes. On those subsequent passes, TaskForce will spend increasing time periods to thoroughly retrieve the data from the bad sectors. If data is eventually read in the corresponding sectors on all but one of the RAID members, then data reconstruction becomes possible again. In the end, TaskForce will be able to provide you with a complete image of the RAID.
Imaging completed report: successful imaging RAID 5 array with errors on multiple drives
When Atola TaskForce completes imaging, it automatically generates the Imaging completed report. The report informs the operator about all the details: RAID configuration, its members, the imaged sector range, calculated hash, etc.
You can see from the report that TaskForce managed to successfully reconstruct and image the data. That is why the number of errors in the Imaging completed report is zero.
With 2020.7 firmware, Atola TaskForce supports RAID imaging and provides a breakthrough configuration autodetection module for RAID 0, 1 and 5 with NTFS and ext4/3/2 file systems. Atola team is working to support more RAID types and file systems in the upcoming releases.
- RAID imaging made easy with TaskForce - May 3, 2022
- Image. Anything. Fast.What makes TaskForce the ultimate forensic imager - February 9, 2022
- RAID configuration detection in Atola TaskForce - April 7, 2021
Olga Milishenko
Olga believes that marketing is about letting the target audience fall in love with your product. She takes pleasure in catching the coolest features of Atola imagers with her camera.
