A Computer hardware and components forum. ComputerBanter.com

If this is your first visit, be sure to check out the FAQ by clicking the link above. You may have to register before you can post: click the register link above to proceed. To start viewing messages, select the forum that you want to visit from the selection below.

Go Back   Home » ComputerBanter.com forum » General Hardware & Peripherals » Storage (alt)
Site Map Home Authors List Search Today's Posts Mark Forums Read Web Partners

RAID array, wiping 'defunct' drive?



 
 
Thread Tools Display Modes
  #1  
Old October 5th 06, 03:02 PM posted to comp.sys.ibm.pc.hardware.storage
RayMan!
external usenet poster
 
Posts: 1
Default RAID array, wiping 'defunct' drive?

Hi all, I have been asked by my paranoid management to wipe a failed
drive on an IBM RAID array that was marked 'defunct' before replacing
it.
I'm not sure if this is possible with the drive being marked 'defunct'
regardless where it is inserted, let alone necessary since the data on
it is already striped.
This disk is part of a 14 disk RAID 5 array, configured as one large
drive, further split into 2 logical drives in the operating system.

My question is: is it possible for a hacker (could be the disgruntled
service guy) to get any type of usable data off one hard disk from such
a complex configuration? According to the BIOS, the data is striped
into 8K segments, and the drive still spins powered up.

Thanks guys.

Ray!

  #2  
Old October 5th 06, 03:32 PM posted to comp.sys.ibm.pc.hardware.storage
Arno Wagner
external usenet poster
 
Posts: 2,791
Default RAID array, wiping 'defunct' drive?

Previously RayMan! wrote:
Hi all, I have been asked by my paranoid management to wipe a failed
drive on an IBM RAID array that was marked 'defunct' before replacing
it.
I'm not sure if this is possible with the drive being marked 'defunct'
regardless where it is inserted, let alone necessary since the data on
it is already striped.


Good point. For many applications, that can be counted as reasonably
secure. Still, if the stripe size is larger than that of a
file, the file may be comletely on the disk.

This disk is part of a 14 disk RAID 5 array, configured as one large
drive, further split into 2 logical drives in the operating system.


My question is: is it possible for a hacker (could be the disgruntled
service guy) to get any type of usable data off one hard disk from such
a complex configuration?


Yes.

According to the BIOS, the data is striped
into 8K segments, and the drive still spins powered up.


So all files 8kB are at risk.

If the drive spins, then you should be able to overwrite it.
Remove it from the array and wipe it as a single drive. Typical
scenario is to connect it to a PC with this as only drive
and the PC bootet with Knoppix. Then do a

dd_rescue -w /dev/zero /dev/youdrishere

There is a remote possibility that data may be in reallocated
sectors. It would be hard but possible to get at them, I think.
This would require hacking the firmware. Protect against this
with physical destruction. Also, depending on what your
time and the defect disk is worth, that may be the ceapest
way to ''wipe'' the disk anyways. For physical destruction,
open the dive, remove the platters and bend them. Any data
recovery will be extremely expensive after that.

Arno
  #3  
Old October 5th 06, 07:06 PM posted to comp.sys.ibm.pc.hardware.storage
Rod Speed
external usenet poster
 
Posts: 8,600
Default RAID array, wiping 'defunct' drive?

RayMan! wrote:

I have been asked by my paranoid management to wipe a
failed drive on an IBM RAID array that was marked 'defunct'
before replacing it. I'm not sure if this is possible with the
drive being marked 'defunct' regardless where it is inserted,


Corse its possible to wipe it as a stand alone drive in some
other system, at least at the level of the sectors the drive
still presents and which havent been mapped away as bad.

let alone necessary since the data on it is already striped.


Its always possible to get access to the fragments and
its possible that there may be some useful data in those.

This disk is part of a 14 disk RAID 5 array, configured as one large
drive, further split into 2 logical drives in the operating system.


My question is: is it possible for a hacker (could be the
disgruntled service guy) to get any type of usable data
off one hard disk from such a complex configuration?


Yes, most obviously with those 8K fragments.

According to the BIOS, the data is striped into
8K segments, and the drive still spins powered up.


Simplest to physically destroy the drive.


  #4  
Old October 5th 06, 10:24 PM posted to comp.sys.ibm.pc.hardware.storage
Odie Ferrous
external usenet poster
 
Posts: 125
Default RAID array, wiping 'defunct' drive?

"RayMan!" wrote:

Hi all, I have been asked by my paranoid management to wipe a failed
drive on an IBM RAID array that was marked 'defunct' before replacing
it.
I'm not sure if this is possible with the drive being marked 'defunct'
regardless where it is inserted, let alone necessary since the data on
it is already striped.
This disk is part of a 14 disk RAID 5 array, configured as one large
drive, further split into 2 logical drives in the operating system.

My question is: is it possible for a hacker (could be the disgruntled
service guy) to get any type of usable data off one hard disk from such
a complex configuration? According to the BIOS, the data is striped
into 8K segments, and the drive still spins powered up.

Thanks guys.

Ray!


Give "management" a large hammer and ask them to smash the drive to
bits.

If they're that paranoid about it, the loss of a single drive can't be
an issue.

Especially if the drive is suspect in the first case.



Odie
--
Retrodata
www.retrodata.co.uk
Globally Local Data Recovery Experts
  #5  
Old October 5th 06, 11:19 PM posted to comp.sys.ibm.pc.hardware.storage
Folkert Rienstra
external usenet poster
 
Posts: 1,294
Default RAID array, wiping 'defunct' drive?

"Arno Wagner" wrote in message
Previously RayMan! wrote:
Hi all, I have been asked by my paranoid management to wipe a failed
drive on an IBM RAID array that was marked 'defunct' before replacing
it.
I'm not sure if this is possible with the drive being marked 'defunct'
regardless where it is inserted, let alone necessary since the data on
it is already striped.


Good point. For many applications, that can be counted as reasonably
secure. Still, if the stripe size is larger than that of a file, the file may
be comletely on the disk.


Files don't have to be complete to be of interest. It's whatever the stripe
size is that is chunks of readable data, whether complete or incomplete.


This disk is part of a 14 disk RAID 5 array, configured as one large
drive, further split into 2 logical drives in the operating system.


My question is: is it possible for a hacker (could be the disgruntled
service guy) to get any type of usable data off one hard disk from such
a complex configuration?


Yes.

According to the BIOS, the data is striped
into 8K segments, and the drive still spins powered up.


So all files


1 in 13, actually.

8kB are at risk.


If the drive spins, then you should be able to overwrite it.


Clueless babblebot, as always.

Remove it from the array and wipe it as a single drive.


Typical


As with all babblebot bull****.

scenario is to connect it to a PC with this as only drive
and the PC bootet with Knoppix. Then do a

dd_rescue -w /dev/zero /dev/youdrishere

There is a remote possibility that data may be in reallocated sectors.
It would be hard but possible to get at them, I think.
This would require hacking the firmware. Protect against this
with physical destruction. Also, depending on what your
time and the defect disk is worth, that may be the ceapest
way to ''wipe'' the disk anyways. For physical destruction,
open the dive, remove the platters and bend them. Any data
recovery will be extremely expensive after that.

Arno

 




Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

vB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Forum Jump

Similar Threads
Thread Thread Starter Forum Replies Last Post
SATA drives in the cosmos . . . I don't use no stinking drive sleds . . . Stan Shankman Storage (alt) 0 May 12th 06 12:33 AM
How I built a 2.8TB RAID storage array Yeechang Lee Storage (alt) 42 March 3rd 05 01:04 AM
P4C800-E Delux: Setting up SATA Drives with RAID Will Asus Motherboards 13 July 12th 04 04:33 AM
How to set up RAID 0+1 on P4C800E-DLX MB -using 4 SATA HDD's & 2 ATA133 HHD? Data Wing Asus Motherboards 2 June 5th 04 03:47 PM
Network File Server Bob Storage (alt) 37 May 4th 04 09:07 PM


All times are GMT +1. The time now is 09:44 AM.


Powered by vBulletin® Version 3.6.4
Copyright ©2000 - 2018, Jelsoft Enterprises Ltd.
Copyright 2004-2018 ComputerBanter.com.
The comments are property of their posters.