NAS RAID configuration overwritten by ransomware

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Hi everyone,

Is there a way to force mdadm to assemble a certain set of drives into
a particular RAID format? A friend of mine had a NAS that was hit with
ransomware. His setup was a RAID-5, 64kb chunk size, 4x4TB, XFS
filesystem setup, while during the attack, they overwrote the config
to be RAID-0/512kb chunk size (it is a Buffalo NAS, running Linux with
libmd). He pulled the plug while it was in the process of formatting
the XFS filesytem. Much of the data I have been able to recover, but
now it would be a lot nicer for me if I could access a raw /dev device
assembled as RAID-5/64kb chunk (rather than the current RAID-0
mdadm/mdstat currently shows), instead of using a tool like UFS
Explorer to assemble it properly for me. Obviously, minimal
(preferably none) writes to the disk if possible. I was afraid to
start throwing mdadm assemble and create commands around. Could
someone please advise on best path forward?

Thanks in advance,
Mike




[Index of Archives]     [Linux RAID Wiki]     [ATA RAID]     [Linux SCSI Target Infrastructure]     [Linux Block]     [Linux IDE]     [Linux SCSI]     [Linux Hams]     [Device Mapper]     [Device Mapper Cryptographics]     [Kernel]     [Linux Admin]     [Linux Net]     [GFS]     [RPM]     [git]     [Yosemite Forum]


  Powered by Linux