26 Mar
2024
26 Mar
'24
7:08 a.m.
On 3/26/2024 9:15 AM, Paul Koning wrote:
Don't know, but doubt it. Some of the disks have probably been used
for other purposes since the VAXen went away more than 20 years ago.
On Mar 26, 2024, at 8:57 AM, Bill Gunshannon via
cctalk <cctalk(a)classiccmp.org> wrote:
On 3/25/2024 9:51 PM, Henry Bent wrote:
Do you have just part of the RAID set, or enough disks to make a complete one? On Mon, 25 Mar 2024 at 20:14, Bill Gunshannon via
cctalk <cctalk(a)classiccmp.org <mailto:cctalk@classiccmp.org>> wrote:
Oops. I guess the fingers work as good as the memory. Sorry
about that. I've got about 20 of them. I know they haven't
been used since they were taken out of the VAX Cluster I ran
at the University. Nothing I have used the SB boxes with since
then would know what to do with 9GB of disk space. :-)
But, if needed I could probably test them on a PC I have with
an Adaptec SCSI in it. It's intended for Ersatz-11 but I expect
does could use a disk that big. Too bad there's no way to read
them. Might be some interesting stuff left behind by the VAX.
Why is there no way to read them? If you have a PC with a SCSI card you can easily boot
into the Linux or BSD distro of your choice and make a dd (or ddrescue) image of the
entire drive, which could then be accessed by whatever means.
These disks were part of a really large RAID array in a SAN connected to
the VAX cluster. There is no way of reconstructing it and so no way to
extract usable information.
bill If the latter then it's a matter of reverse
engineering the RAID layout,
which is likely to be doable.
While possible, I think hardly likely. I don't even remember what the
appliance was. Something DECish.
bill
26 Mar
26 Mar
9:48 a.m.
On Mar 26, 2024, at 10:08 AM, Bill Gunshannon via
cctalk <cctalk(a)classiccmp.org> wrote:
On 3/26/2024 9:15 AM, Paul Koning wrote:
Don't know, but doubt it. Some of the disks have probably been used
for other purposes since the VAXen went away more than 20 years ago.
Chances are those were classic RAID systems, with fixed layouts across much of the RAID
set (not "mapped RAID") exposing what looks like a regular device LUN (no page
based virtualization). If so, there is only a limited set of possibilities, basically a
question of stripe sizes, drive count, and drive order. Given a guess (or better) of
what's on it, such as what file system type, the right layout would be clear from the
fact that it produces valid content.
It would be a pain to try this with modern complex SAN devices, but with those of 30+
years ago it's not quite so bad.
paul
On Mar
26, 2024, at 8:57 AM, Bill Gunshannon via cctalk <cctalk(a)classiccmp.org> wrote:
...
Do you have just part of the RAID set, or enough disks to make a complete one?
If the latter then it's a matter of reverse
engineering the RAID layout, which is likely to be doable.
While possible, I think hardly likely. I don't even remember what the
appliance was. Something DECish. 
11:59 a.m.
and, if you inquire in the right places, there is law enforcement
focused forensic analysis software specifically designed to acquire RAID
volumes and rebuild the data.
Steve
On 3/26/24 9:48 AM, Paul Koning via cctalk wrote:
On Mar 26, 2024, at 10:08 AM, Bill Gunshannon via
cctalk<cctalk(a)classiccmp.org> wrote:
On 3/26/2024 9:15 AM, Paul Koning wrote:
Don't know, but doubt it. Some of the disks have probably been used
for other purposes since the VAXen went away more than 20 years ago.
Chances are those were classic RAID systems, with fixed layouts across much of the
RAID set (not "mapped RAID") exposing what looks like a regular device LUN (no
page based virtualization). If so, there is only a limited set of possibilities,
basically a question of stripe sizes, drive count, and drive order. Given a guess (or
better) of what's on it, such as what file system type, the right layout would be
clear from the fact that it produces valid content.
It would be a pain to try this with modern complex SAN devices, but with those of 30+
years ago it's not quite so bad.
paul
On Mar
26, 2024, at 8:57 AM, Bill Gunshannon via cctalk<cctalk(a)classiccmp.org> wrote:
...
Do you have just part of the RAID set, or enough disks to make a complete one?
If the latter then it's a matter of reverse
engineering the RAID layout, which is likely to be doable.
While possible, I think hardly likely. I don't even remember what the
appliance was. Something DECish.
12:22 p.m.
On Mar 26, 2024, at 2:59 PM, steve shumaker via cctalk
<cctalk(a)classiccmp.org> wrote:
and, if you inquire in the right places, there is law enforcement focused forensic
analysis software specifically designed to acquire RAID volumes and rebuild the data.
Steve
Yes, though from the one time I encountered that use case I have my doubts about it. I
was asked to help with such a forensic analysis case, and the person I worked with started
by asking me about the "BIOS settings" on our SAN array, and whether the setting
was "left to right" or "right to left". For some reason, that person
could not cope with answers like "we don't have a BIOS" and "neither
left-to-right nor right-to-left". Once I hit that road block I decided not even to
bother mentioning that our SAN device included page based virtualization. Never did hear
anything further. :-)
paul
6:29 p.m.
Yep. That's been a problem for decades although it's slowly improving
as even the smaller departments realize it and fund serious training.
Meantime, yes, one needs to approach getting involved with those folks
with some degree of caution.
Steve
Special Agent, (ret)
On 3/26/24 12:22 PM, Paul Koning via cctalk wrote:
On Mar 26, 2024, at 2:59 PM, steve shumaker via
cctalk<cctalk(a)classiccmp.org> wrote:
and, if you inquire in the right places, there is law enforcement focused forensic
analysis software specifically designed to acquire RAID volumes and rebuild the data.
Steve
Yes, though from the one time I encountered that use case I have my doubts about
it. I was asked to help with such a forensic analysis case, and the person I worked with
started by asking me about the "BIOS settings" on our SAN array, and whether the
setting was "left to right" or "right to left". For some reason, that
person could not cope with answers like "we don't have a BIOS" and
"neither left-to-right nor right-to-left". Once I hit that road block I decided
not even to bother mentioning that our SAN device included page based virtualization.
Never did hear anything further. :-)
paul
6:47 p.m.
if you ever get a request to forense a raid for Solaris, take whatever $$ they offer you.
just plug 'em in anywhere, diff controllers, different sequence, no matter. they have
fingerprints, the os will figure out and mount the raid, including recovery mode if one is
missing.
<pre>--Carey</pre>
On 03/26/2024 8:29 PM CDT steve shumaker via cctalk
<cctalk(a)classiccmp.org> wrote:
Yep. That's been a problem for decades although it's slowly improving
as even the smaller departments realize it and fund serious training.
Meantime, yes, one needs to approach getting involved with those folks
with some degree of caution.
Steve
Special Agent, (ret)
On 3/26/24 12:22 PM, Paul Koning via cctalk wrote:
>
>> On Mar 26, 2024, at 2:59 PM, steve shumaker via
cctalk<cctalk(a)classiccmp.org> wrote:
>>
>> and, if you inquire in the right places, there is law enforcement focused
forensic analysis software specifically designed to acquire RAID volumes and rebuild the
data.
>>
>> Steve
> Yes, though from the one time I encountered that use case I have my doubts about it.
I was asked to help with such a forensic analysis case, and the person I worked with
started by asking me about the "BIOS settings" on our SAN array, and whether the
setting was "left to right" or "right to left". For some reason, that
person could not cope with answers like "we don't have a BIOS" and
"neither left-to-right nor right-to-left". Once I hit that road block I decided
not even to bother mentioning that our SAN device included page based virtualization.
Never did hear anything further. :-)
>
> paul
>
27 Mar
27 Mar
11:51 p.m.
On 3/26/24 20:47, CAREY SCHUG via cctalk wrote:
if you ever get a request to forense a raid for
Solaris, take whatever
$$ they offer you. just plug 'em in anywhere, diff controllers,
different sequence, no matter. they have fingerprints, the os will
figure out and mount the raid, including recovery mode if one is
missing.
I did a recovery on a ReadyNAS device created on the original Netgear
devices which used the mini sparc linux. unfortunately the raid array
software they used there had 4k setup, and at the time the Linux on i86
was all 512 byte block sized.
though the original reason i favored ReadyNAS was because they used
Linux instead of some proprietary raid chip which might or might not be
supported, the 4k vs 512 byte took some doing.
it didn't "just work" at all.
And Netgear discontinued the Sparc version in favor of x86 and the
problem subsequently went away.
The problem was by the way that the recovery scan stalled on real small
physical defect block areas. I had to go in and manually map out the
files with the errors, which were luckily not ones I required as had
other copies, but Netgear didn't fix the problem on the original boxes.
They could recover if you could replace an entire disk, but when there
was a small defect, nope.
thanks
Jim
BTW the recovery at the time required building a driver I found and
adding it to the kernel. Not a fun or quick task.
36
days inactive
38
days old
6 comments
5 participants
participants (5)
-
Bill Gunshannon -
CAREY SCHUG -
jim stephens -
Paul Koning -
steve shumaker