[Pasig-discuss] Write-blocking a RAID

[Joseph Pawletko]

Hello, All.

I've been asked by some of our archivists to preserve the contents of a
RAID (and a server)
and I'm looking for write-blocking strategies so that the file
Modify-Access-Change data are not
modified.

I discussed this problem with Mark Matienzo, who gave me permission to
forward the email below
in case others are trying to solve the same problem.

Has anyone used a strategy different from those outlined by Mark?

Thank you for your time.

Best-
Joe

-- 
Joe Pawletko
Digital Library Technology Services
Bobst Library
New York University

---------- Forwarded message ----------
From: Mark A. Matienzo <mark.matienzo at nyu.edu>
Date: Tue, Oct 23, 2012 at 12:48 PM
Subject: RAID acquisition
To: Joe Pawletko <jgp at nyu.edu>


My understanding is that there seem to be two camps:

1) Acquire the contents of the array over a network, which requires the
system to be live. This option is obviously less ideal because the contents
of the system may change (logs, etc.), but doesn't require you to know as
much about what RAID level the array is running.

2) Acquire each drive individually, removing them from the array. This
obviously requires the system to be dead, but may add considerably
additional work since you need to reassemble the array. This may be
preferable if you know less about the system. There are a few different
applications that can help with this: RAID Reconstructor <
http://www.runtime.org/raid.htm>; X-Ways Forensics; EnCase. The specific
software will depend on whether it's a software or hardware array.

I don't really know what's preferable in this case - I think it largely
depends on what you know about the server.

Mark
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mail.asis.org/pipermail/pasig-discuss/attachments/20121101/1bc5ca55/attachment.html