ReclaiMe Data Recovery Training

RAID Recovery Course - Overall Test

What does content analysis help determine?

RAID level
block size
disk order

Look at the picture on the right and guess the possible RAID level

Full RAID 5 with a hotspare
RAID10
Full RAID5
RAID 5 with a missing disk

Is it possible to recover data if one of the member disks in a RAID5 failed?

yes, but only part of the data is recoverable
no
depends on which disk failed
yes, all data is recoverable

Is it possible to recover data if one of the member disks in a RAID10 failed?

yes, all data is recoverable
depends on which disk failed
no
yes, but only part of the data is recoverable

When to apply entropy analysis?

before content analysis
between zero and mirror analysis
after content analysis

Look at the picture on the right and choose the most complete configuration

full 4-disk RAID5, 16 KB block size
full 4-disk RAID5, 64 KB block size
full 4-disk RAID5, 32 KB block size
4-disk RAID5 with one disk missing, 32 KB block size

What is the first step in RAID recovery?

mirror analysis
collecting all the information available about the case
RAID configuration recovery
entropy analysis

If data recovered from a RAID is incorrect it means that

both filesystem or RAID recovery might fail, investigation is needed
filesystem recovery failed
RAID configuration recovery failed

Check what you can do with entropy analysis

spot the disks which do not form a parity-based array
spot the disks which do not belong to the RAID in question
detect the first disk in the RAID
notice that start offset doesn't equal zero

Look at the picture on the right and guess the possible RAID level

Full RAID6
Full RAID 6 with a hotspare
RAID 5 with a blank disk
RAID6 with a missing disk

Return to the list of lessons

We have a mailing list in which we talk about interesting cases we encounter and share some tips and tricks.