Re: dumping a raid member with 'dd' for insurance...

[Chuck Swiger]

Hi--

On May 11, 2010, at 3:35 PM, George Sanders wrote:
> [ ... ]
> I am planning on attaching each individual member of the raid5 array to a 
> test FreeBSD system, and run:
> 
> dd if=/dev/ad1 of=/data/disk/image.file
> 
> Two questions:
> 
> - is that a complete 'dd' command, or do I need to specify "bs=xxx" and 
> "count=xxx"  ?

What you've suggested should work as-is.  Adding the count option isn't useful, 
but specifying a bs of 64k or larger will considerably speed up the process of 
copying the data.  Since you're dealing with a failed array and it's possible 
some of the disks might have errors when read, using conv=noerror might also be 
a good idea.

> - is there any chance that simply booting with this drive attached to the 
> system, and running a 'dd' like this, will somehow alter the contents or 
> "touch" the array member in any way ?  What I have described above appears to 
> be a completely read-only process, but I'd like to make sure there aren't ANY 
> bits that FreeBSD will write to this disk ...

Many disks have a write-protect jumper which you can use to make sure no 
changes get written.

Regards,
-- 
-Chuck

___
freebsd-questions@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to "freebsd-questions-unsubscr...@freebsd.org"

dumping a raid member with 'dd' for insurance...

[George Sanders]

A 3ware raid5 array I had died.

It looks like the data is intact, and there are two good recovery methods:

1) a toolchain from 3ware that, if it doesn't work, will destroy the data.  
This method is free, and I can do it myself.

2) professional forensic services.  Costs a lot.

I'm going to start with #1, but before I do I want to image the individual 
drive members so that I can go to method #2 if necessary.

I am planning on attaching each individual member of the raid5 array to a test 
FreeBSD system, and run:

dd if=/dev/ad1 of=/data/disk/image.file

Two questions:

- is that a complete 'dd' command, or do I need to specify "bs=xxx" and 
"count=xxx"  ?

- is there any chance that simply booting with this drive attached to the 
system, and running a 'dd' like this, will somehow alter the contents or 
"touch" the array member in any way ?  What I have described above appears to 
be a completely read-only process, but I'd like to make sure there aren't ANY 
bits that FreeBSD will write to this disk ...

Thak you.


  

___
freebsd-questions@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to "freebsd-questions-unsubscr...@freebsd.org"