3
The title pretty much sums it up - if someone were to mount a single drive from a software RAID 5 array, what would they see? Would it point to being part of a RAID array, appear as encrypted data, or just look like random noise?
Lachlan
Posted 2011-07-25T08:39:26.557
Reputation: 31
3
Firstly, you wouldn't be able to mount it, since it wouldn't contain a valid filesystem.
RAID level 5 is block-level striping with distributed parity, which means that if you examined the contents of the disc you would see a slice of the usable blocks in the filesystem interspersed with parity blocks.
Ignacio Vazquez-Abrams
Posted 2011-07-25T08:39:26.557
Reputation: 100 516
3
Each hardware volume that's in an md-RAID array contains a superblock. The superblock (which can be located either near the beginning or near the end of the volume) contains a magic number as well as various critical data including a unique identifier for the array and an indication of what the volume is (which lets the driver assemble the components of the array properly).
Thus you will be able to identify the drive. You won't be able to mount a single drive from the array, since it doesn't contain a filesystem. Since RAID-5 uses block-level striping, you will see small chunks of coherent data (in an N-disk array, 1 block in N is parity data and will not make sense, and the other N-1 are data blocks).
Gilles 'SO- stop being evil'
Posted 2011-07-25T08:39:26.557
Reputation: 58 319
So, when you say that you would be able to identify the drive, you mean it would be immediately obvious that it was part of a software RAID 5 Array?
Thanks for the information! – Lachlan – 2011-07-25T09:26:23.663
The partition type of the disk will be set to 'fd' (Linux RAID autodetect), which is a big clue. – Linker3000 – 2011-07-25T10:01:13.190
@Linker3000 That will often be the case in practice, but I don't think the Linux kernel cares about the partition type for RAID components. The presence of the superblock (identified by a magic number) is what matters. – Gilles 'SO- stop being evil' – 2011-07-25T11:09:07.073
@Lachlan Yes, it has to be immediately obvious to the kernel, so that it can assemble the array at boot time. – Gilles 'SO- stop being evil' – 2011-07-25T11:10:39.010
1Thanks for the quick answer!
I'm aware of what RAID 5 is, although admittedly I didn't give much information to suggest that.
So if it can't be mounted, what would somebody see if they looked at the drive using gparted, a disk manager, or using the terminal? – Lachlan – 2011-07-25T08:47:56.190
@Lachlan: They would see that it is an empty disk with data arranged in a format they don't understand. I think Gparted shows this as a black box. – surfasb – 2011-07-27T00:25:54.997