Re: [sleuthkit-users] recombine raid images with loopback?

[Brian C. <ca...@sl...>]

I have tried to recreate RAIDs before using loopback and the RAID  
support in the Linux kernel (similar to your raiddev example), but I  
was unsuccessful.  I don't remember the details anymore because I'm  
in the middle of a move and all of my stuff is packed up.  But, it  
may work in newer versions of the kernel.

brian



On Jan 29, 2006, at 10:46 PM, J B wrote:

> Suppose you have a raid of 8 9GIG disks.
> You have imaged each disk using dd so that you have diskimg0 ...  
> diskimg7
>
> What's the best way to mount this group of images in software so  
> that you
> can then operate on it using TSK?  I assume it involves mounting a  
> loopback
> device..
>
> it's seems like you'd want to use /dev/loopX in raiddev per disk
>
> but I'm not sure that:
> mount -ro /evidence/diskimg0 /whocareswhere -t whatevertype -o  
> loop=/dev/loop0, blocksize= (CHUNKSIZE?)
> would be appropriate.  Seems like you're mounting the image  
> unneccesarily leaving the mounted stub at /whocareswhere when all  
> you really want is to tie loop0 to the image...
>
> raiddev /dev/md0
>        raid-level      linear
>        nr-raid-disks   2
>        chunk-size      32
>        persistent-superblock 1
>        device          /dev/loop0
>        raid-disk       0
>        device          /dev/loop1
>        raid-disk       1
>
>
> Just curious,
>
> -Jessop
>
>
>
>
> -------------------------------------------------------
> This SF.net email is sponsored by: Splunk Inc. Do you grep through  
> log files
> for problems?  Stop!  Download the new AJAX search engine that makes
> searching your log files as easy as surfing the  web.  DOWNLOAD  
> SPLUNK!
> http://sel.as-us.falkag.net/sel? 
> cmd=lnk&kid=103432&bid=230486&dat=121642
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org