EH-Net

First of all I am sorry if this is in the wrong section.

I figured that this issue I am having would best be suited here. I know nothing about forensics but I am ready to learn. I have an issue and my wife is about to kill me if I can not fix the problem. I had my desktop setup where I had the OS running off of a SSD drive and then I had 3 400gb SATA hard drives in a Raid 5 configuration off of the mother board to support all of the pictures, movies, music and stuff. This worked well since the hard drives were cheap and I had one fail and replacing it was not an issue since it picked the RAID back up with out a problem.

Well my motherboard bit the dust and its an outdated Gygabyte motherboard (I do not know what exact model since I am on deployment 1/2 a world away) I was troubleshooting this right before I left for deployment with no love.

We have lots of pictures and stuff on those drives, I was unable to successfully mount them to any operating system without them requesting to be formatted first. I bought another motherboard with a raid controller but it wants to rebuild the raid from scratch and format the drives.

Is there any way for me to get the pictures off of those 3 hard drives? (pictures of my Son from birth to his 2 year birthday and many others)

Thanks for any advice and direction you can send me. I am wanting to do this myself and make it a learning experience to get into the forensic hard drive stuff, but I really don't know where to start.

Ryan L.

I love R-Studio for data recovery. I've personally never used this feature, but they claim to be able to create a virtual RAID array with valid drives and allow you to recover data that way: http://www.r-tt.com/Articles/RAID_Recovery_Presentation/

If you can't find the same motherboard, try and identify which RAID controller the motherboard used. A different motherboard with the same controller may allow you to get your array back.

I have never seen R-Studio, that looks like it is going to be the trick.

I could not purchase the same motherboard but I did purchase one with the same raid controller and it would not recognize it.

Thanks guys, I knew I would find my answer in here

Ryan L.

Did you configure the RAID BIOS in the same manner as original system? It should have recognized the array.

Yes, everything was configured the same, the only thing that was might have been off is the order of the hard drives. Being 9 different combinations of which one connects to what might have been the limiting factor and the time crunch I was under before deploying.

After I get this fixed I am going back to a raid 0 and doing offsite backups instead.

Ryan L.

Even with RAID 5, you should always be doing backups.  If you don't have 2 or more copies of a file, it isn't backed up :D  Live and learn.  Good luck with the R-Studio, let us know how it pans out!