Re: [sleuthkit-users] Examining RAID-5 with only 1 drive

[Colby Gutierrez-K. <co...@ge...>]

On Nov 10, 2006, at 1:24 PM, Simson L. Garfinkel's Treo 700p wrote:

>
> ___
> Sent with SnapperMail
> www.snappermail.com
>
> ...... Original Message .......
> On Fri, 10 Nov 2006 09:39:28 -0800 "Colby Gutierrez-Kraybill"
> <co...@ge...> wrote:
>>
>> On Nov 10, 2006, at 8:50 AM, DePriest, Jason R. wrote:
>>
>>>
>>> I am only assuming this is RAID-5 since "the other two drives" were
>>> mentioned as being discarded.
>>>
>>
>> It could be from a RAID-3, and if it's the parity drive from that  
>> set,
>> then the chance of getting anything useful off of it is 0%.  If it's
>> one of the other disks from the RAID-3, then chances are about 50%
>> in the best case (see data block size vs actionable data below).
>
>
> Who uses RAID-3? Most controllers don't even support it...


The XFX Revo64 3-port does.  I don't think it was out 3+ years ago  
though.
Don't know other controllers that support it off the top of my head.   
Use
them a lot because they are transparent to the OS.

I also pointed out in a private e-mail that perhaps you could get  
information
off of the parity drive if you already knew the text you were looking  
for
and approached the problem from the angle of retrieving a key  
(missing info)
when you already have the known text (keyword(s)) and the crypt text
(parity info) available.

Just depends on how hard you're willing to work for it and whether or
not you can convince a court that the information really is there.

Or maybe I'm being daft.

- Colby