From owner-freebsd-questions@FreeBSD.ORG Tue May 11 22:48:39 2010 Return-Path: Delivered-To: questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52]) by hub.freebsd.org (Postfix) with ESMTP id 3ECE8106564A for ; Tue, 11 May 2010 22:48:39 +0000 (UTC) (envelope-from gosand1982@yahoo.com) Received: from n21.bullet.mail.mud.yahoo.com (n21.bullet.mail.mud.yahoo.com [68.142.206.160]) by mx1.freebsd.org (Postfix) with SMTP id ED25B8FC15 for ; Tue, 11 May 2010 22:48:38 +0000 (UTC) Received: from [68.142.200.227] by n21.bullet.mail.mud.yahoo.com with NNFMP; 11 May 2010 22:35:33 -0000 Received: from [67.195.9.82] by t8.bullet.mud.yahoo.com with NNFMP; 11 May 2010 22:35:35 -0000 Received: from [67.195.9.110] by t2.bullet.mail.gq1.yahoo.com with NNFMP; 11 May 2010 22:35:35 -0000 Received: from [127.0.0.1] by omp114.mail.gq1.yahoo.com with NNFMP; 11 May 2010 22:35:34 -0000 X-Yahoo-Newman-Property: ymail-3 X-Yahoo-Newman-Id: 996059.87041.bm@omp114.mail.gq1.yahoo.com Received: (qmail 39137 invoked by uid 60001); 11 May 2010 22:35:34 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s1024; t=1273617334; bh=opRKCnRuAirJpn46ZlnEu/HQnT6tc0hnvEmn4oXqdvA=; h=Message-ID:X-YMail-OSG:Received:X-Mailer:Date:From:Subject:To:MIME-Version:Content-Type; b=m2Ac5I9JjqZ0AuG7t7X80ecoyAZp8OtVO5K1zGTSZ9ZuVF/TZMNRi5WK+7gVvion1rhgXhC+htdqbMMF+zOcfo9H8OCxSqQ+H2iPdLcCyy1GwsdtijT+70Fo+kaFZWA2EGJA+PbEBomUBCZOYNESQdQL/1icu9UFdiXsLZXnbrM= DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=s1024; d=yahoo.com; h=Message-ID:X-YMail-OSG:Received:X-Mailer:Date:From:Subject:To:MIME-Version:Content-Type; b=duVV5VkLIkux15T+1aUCzhGbztqC9I6y4ohyv2oAUPTiU+XqdBLm12Ht2rHBLSJtspAHaq4LEFfxGGfxfkGSW1QZ9BGp7JfPsz2eEU1r5JJkeDdNwVCEZ38MjqeoaxH8XbK/qwoldDWnSxxCtAmdxrAvj8AMAXgT0O16pXdU2uc=; Message-ID: <914660.33515.qm@web111619.mail.gq1.yahoo.com> X-YMail-OSG: EjouJJIVM1mZEIudCkrxUdN9slLgJb4ARgW4f6L_Ifo.gFS bPq8xCd1RGoRJJ83vKr9n51HM53E9aw.wXSpJLFCmpnCJEkxF8lLHAvea0ga UWRfvqougZvS0gppKgYRyKjfPXE7fI0nR4JKY.uE6DXsysjYMjmvHz7ueN2p dWALmSw34K5SBv6DclX8wesKSgW5uzZHuEzKdh_fugxwwxB2IfTbi7EmWkOp el331Gz72m7SxbvqYwQ_4llEzcInZcn4- Received: from [32.172.98.62] by web111619.mail.gq1.yahoo.com via HTTP; Tue, 11 May 2010 15:35:34 PDT X-Mailer: YahooMailRC/374.4 YahooMailWebService/0.8.103.269680 Date: Tue, 11 May 2010 15:35:34 -0700 (PDT) From: George Sanders To: questions@freebsd.org MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Cc: Subject: dumping a raid member with 'dd' for insurance... X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 11 May 2010 22:48:39 -0000 A 3ware raid5 array I had died. It looks like the data is intact, and there are two good recovery methods: 1) a toolchain from 3ware that, if it doesn't work, will destroy the data. This method is free, and I can do it myself. 2) professional forensic services. Costs a lot. I'm going to start with #1, but before I do I want to image the individual drive members so that I can go to method #2 if necessary. I am planning on attaching each individual member of the raid5 array to a test FreeBSD system, and run: dd if=/dev/ad1 of=/data/disk/image.file Two questions: - is that a complete 'dd' command, or do I need to specify "bs=xxx" and "count=xxx" ? - is there any chance that simply booting with this drive attached to the system, and running a 'dd' like this, will somehow alter the contents or "touch" the array member in any way ? What I have described above appears to be a completely read-only process, but I'd like to make sure there aren't ANY bits that FreeBSD will write to this disk ... Thak you.