How much data is retreivable form one disk in a raid 5 array
a month ago by Fortatech to c/techsupport
If i would, hypothetically, have a few different drives in a raid5 array in different physical locations, and one was seized, how much data could be reconstructed from that drive?
(I was reading about A/I and their R* system a bit, and this semi-related idea came to mind)
But how hard is it to reconstruct an image without the file headers? I get that text files are toast if they aren't encrypted, but wouldn't any other filetype that is not human-readable be very hard to retreive?
What are you trying to achieve anyway? I feel I can't give good advice because there's so much specifics to factor in. Also I don't even know if I'd like to help you, depending on what kinds of illegal stuff you're up to in this "hypothetical" situation!
That would depend a lot on the configuration.
What filesystem was used?
How full was the array?
Did you configure encryption?
What kind of data was stored on the array?
To be frank, I have no idea about this, but all of the above are things that affect the raid array.
In cases like this, you need to plan for the worst, so you are prepared for it if it happens.
It would probably be an ext4 fs and lets say the array is 20% used.
In any real world application i would have encryption, but for the sake of this hypothetical, i don't.
And about the data, it would probably be a mixture of big and small files like text files, videos and images.
It stores large chunks of data the size of the stripe width. This could easily be large enough to contain a whole text file, and enough of binaries to reasonably guess aa to what they are. Encryption may slow down IO, but if you even remotely worry about seizure you should absolutely be using it.
Plus we have hardware accelerated AES in most CPUs for like 15 years now?! I encrypt all my devices in case they get stolen or something and since then, I never noticed any noticeable CPU load due to that anymore. Should be the same for storage systems. And if there's spinning disks or SATA inside, you don't even need to worry. That'll slow it down enough and you won't notice the CPU is doing stuff as well.
If someone is coming physically for your stuff, They wont just take a drive, they will take the whole thing so they will have access to the whole thing.
This is where drive encryption comes in so when they power it back on it asks for the drive decryption key, of some kind of intermediate key to get the actual key from the TPM.
There is a defcon talk about anti-forensic and anti anti forensic mechanisms you can use to watch to make breaking your system take longer.
@lemmy.world
The Lemmy community will help you with your tech problems and questions about anything here. Do not be shy, we will try to help you.
If something works or if you find a solution to your problem let us know it will be greatly apreciated.
Rules: instance rules + stay on topic
Partnered communities:
go to feed...
@lemmy.world
The Lemmy community will help you with your tech problems and questions about anything here. Do not be shy, we will try to help you.
If something works or if you find a solution to your problem let us know it will be greatly apreciated.
Rules: instance rules + stay on topic
Partnered communities:
go to feed...
Doesn't RAID5 just distribute stripes of the data over the disks plus parity? I think they'd get random stripes of your data. If your stripe size is 128kb, they'd get a 128k chunk of an image here, a part of another image there... Text doesn't use a lot of space so there might be a long text or several emails within some stripe... If you're lucky that was just your spamfolder... If they're lucky, it's the text document containing your master password list plus your confession to all the crimes committed... Chances are they seize the disk with that specific data on it. Or maybe they happen to take one of the other ones. Could be on any of them.
Larger files get distributed over the disks due to striping. Depends on the file type... Maybe parts of large file can be used against you, maybe they can't.
save