Digital Forensics & Incident Response
  • Welcome
  • General Notes
    • Azure Blob storage with NGINX proxy
    • Install and Configure ZeroTier client
    • S3FS Fuse and MinIO
    • Enable nested VT-X/AMD-V
    • mitm proxy
    • Exploring Volume Shadow Copies Manually
    • Resize VMDK/VDI
    • Resize VMDK on ESXi
    • Convert raw to vmdk
    • Favicon hashing and hunting with Shodan
    • WinRM/RemotePS
    • MinIO/S3/R2 ghost files
    • Mount E01 containing VMDK/XFS from RHEL system
    • Disk images for various filesystems and configurations
      • ext4 with LVM and RAID5 (3 disks)
      • ZFS
      • UFS, FFS, BTRFS, XFS
      • ext4, LVM, and LUKS1/LUKS2
      • NTFS, FAT32, with BitLocker
      • NTFS, FAT32, exFAT with TrueCrypt, VeraCrypt
    • VirtualBox adapters greyed out
    • Exporting SQLite blob data from standalone SQLite database using command line tools
  • Microsoft Defender KQL
    • Introduction to KQL
  • Windows Forensics
    • PsExec
      • PsExec and NTUSER data
    • Security Patch/KB Install Date
  • Linux Forensics
    • Inspecting RPM/DEB packages
    • Common Locations
  • ESXi Forensics
    • Mount external USB device in ESXi hypervisor
    • Understanding ESXi
      • Partitions / Volumes
      • ESXi console / shell
      • Guest Virtual Machines
    • General Notes
    • Triage and Imaging
    • ESXi VMFS Exploration
    • Export OVF from ESXi using OVF Tool
    • Identification, acquisition, and examination of iSCSI LUNs and VMFS datastores
  • Memory Forensics
    • Volatility
      • Volatility3 core commands
      • Build Custom Linux Profile for Volatility
      • Generate custom profile using btf2json
      • Banners, isfinfo, and custom profiles
      • Volatility2 core commands
      • 3rd Party Plugins
    • Acquisition
      • ESXi / VMware Workstation snapshots
      • DumpIt
      • WinPMem
      • Linux / AVML
  • Incident Response
    • Ivanti Connect Secure Auth Bypass and Remote Code Authentication CVE-2024-21887
    • VirusTotal & hash lists
    • Unix-like Artifacts Collector (UAC)
      • Setup MinIO (object storage)
      • Create S3 pre-signed URL
      • UAC and pre-signed URLs
    • Acquiring Linux VPS via SSH
    • AVML dump to SMB / AWS
    • China Chopper webshell
    • Logging Powershell activities
    • Compromised UniFi Controller
    • AnyDesk Remote Access
    • Mounting UFS VMDK from NetScaler/Citrix ADC
  • iOS Forensics
    • Checkm8 / checkra1n acquisitions/extractions
  • CTF / Challenges
    • 13Cubed Linux memory forensics
    • Compromised Windows Server 2022 (simulation)
      • FTK Imager
      • Autopsy Forensics
      • Plaso
      • Events Ripper
      • EZ tools
    • DEFCON 2019 forensics
    • Tomcat shells
    • Magnet Weekly CTF
      • Magnet CTF Week 0
      • Magnet CTF Week 1
    • DFIR Madness CTF
      • Case 001 - Szechuan Sauce
  • Log Files
    • Windows
      • Generating Log Timelines
  • Malware Analysis
    • Identifying UPX packed ELF, decompressing, fixing, and analysing Linux malware
    • PDF Analysis
  • Walking the VAD tree
  • OpenCTI
    • What is CTI/OpenCTI?
    • Setting up OpenCTI
    • Container Management
    • Configure Connectors
  • Vulnerability Management
    • Setting Up Nessus (Essentials)
    • Troubleshooting
  • Privacy
Powered by GitBook
On this page

Was this helpful?

  1. General Notes
  2. Disk images for various filesystems and configurations

ext4 with LVM and RAID5 (3 disks)

Single LVM on top of a 3 disk RAID5 array, formatted as ext4

PreviousDisk images for various filesystems and configurationsNextZFS

Last updated 1 year ago

Was this helpful?

Download VMDK (zipped)

Download RAW (zipped)

I've created a 3 disk RAID5 array using mdadm/LVM, which contained a few files to demonstrate how data is striped across an array.

How it was created;

  1. Create file of a fixed size, using a unique string/word which is easily identifiable such as 'APPLE'

The 'yes' command will output the string passed to it (APPLE) continually until killed. It's piped into head, and it'll output a file of a size of 1GB which is redirected to apple.txt

$ yes APPLE | head -c 1073741824 > apple.txt

Do this 3 more times using banana, carrot, date, eggplant, to produce 5 x 1GB text files.

  1. Create 3 x 2GB volumes, attach to virtual machine.

  2. Unwilling to restart the virtual machine, I probed the SCSI host to detect new disks.

$ for host in /sys/class/scsi_host/*; do echo "- - -" | sudo tee $host/scan; ls /dev/sd* ; done
$ lsblk
NAME   MAJ:MIN RM  SIZE RO TYPE MOUNTPOINTS
sda      8:0    0    2G  0 disk
sdb      8:16   0   80G  0 disk
├─sdb1   8:17   0    1M  0 part
├─sdb2   8:18   0  513M  0 part /boot/efi
└─sdb3   8:19   0 79.5G  0 part /
sdc      8:32   0    2G  0 disk
sdd      8:48   0    2G  0 disk

So we have sda, sdc, and sdd.

Create RAID5 volume using mdadm

$ mdadm --create --verbose /dev/md0 --level=5 --raid-devices=3 /dev/sda /dev/sdc /dev/sdd
mdadm: layout defaults to left-symmetric
mdadm: layout defaults to left-symmetric
mdadm: chunk size defaults to 512K
mdadm: size set to 2094080K
mdadm: Defaulting to version 1.2 metadata
mdadm: array /dev/md0 started.

Check block device output prior to creating filesystem

$ lsblk
NAME   MAJ:MIN RM  SIZE RO TYPE  MOUNTPOINTS
sda      8:0    0    2G  0 disk
└─md0    9:0    0    4G  0 raid5
sdb      8:16   0   80G  0 disk
├─sdb1   8:17   0    1M  0 part
├─sdb2   8:18   0  513M  0 part  /boot/efi
└─sdb3   8:19   0 79.5G  0 part  /
sdc      8:32   0    2G  0 disk
└─md0    9:0    0    4G  0 raid5
sdd      8:48   0    2G  0 disk
└─md0    9:0    0    4G  0 raid5
sr0     11:0    1 1024M  0 rom

$ fdisk -l /dev/md0
Disk /dev/md0: 3.99 GiB, 4288675840 bytes, 8376320 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 524288 bytes / 1048576 bytes

Create ext4 filesystem on /dev/md0

$ mkfs.ext4 /dev/md0
mke2fs 1.46.5 (30-Dec-2021)
Creating filesystem with 1047040 4k blocks and 262144 inodes
Filesystem UUID: 63a60555-ea65-4ed4-83f7-e7e851db8f52
Superblock backups stored on blocks:
        32768, 98304, 163840, 229376, 294912, 819200, 884736

Allocating group tables: done
Writing inode tables: done
Creating journal (16384 blocks): done
Writing superblocks and filesystem accounting information: done

Mount volume to /mnt/iblue5 and copy dummy data to it (attempted to copy all 5 x 1GB files, which partially failed due to insufficient space).

$ mkdir /mnt/iblue5
$ mount /dev/mapper/data-iblue /mnt/iblue5
$ ls /mnt/iblue5
lost+found
$ cp /home/user/Desktop/*.txt /mnt/iblue5/
$ ls -lah /mnt/iblue5
total 3.9G
drwxr-xr-x  3 root root 4.0K Dec  9 22:39 .
drwxr-xr-x 17 root root 4.0K Dec  9 22:25 ..
-rw-r--r--  1 root root 1.0G Dec  9 22:38 apple.txt
-rw-r--r--  1 root root 1.0G Dec  9 22:38 banana.txt
-rw-r--r--  1 root root 1.0G Dec  9 22:39 carrot.txt
-rw-r--r--  1 root root 858M Dec  9 22:39 date.txt
-rw-r--r--  1 root root    0 Dec  9 22:39 eggplant.txt
drwx------  2 root root  16K Dec  9 22:37 lost+found

Unmount /dev/md0

$ umount /dev/md0
$ ls /mnt/iblue5
https://files.iblue.team/279b6e00-851e/2GB-ext4-raid5/LINUX-MINT-8.vmdk.7z https://files.iblue.team/279b6e00-851e/2GB-ext4-raid5/LINUX-MINT-7.vmdk.7z https://files.iblue.team/279b6e00-851e/2GB-ext4-raid5/LINUX-MINT-6.vmdk.7z
https://files.iblue.team/279b6e00-851e/2GB-ext4-raid5/LINUX-MINT-8.vmdk.dd.7z https://files.iblue.team/279b6e00-851e/2GB-ext4-raid5/LINUX-MINT-7.vmdk.dd.7z https://files.iblue.team/279b6e00-851e/2GB-ext4-raid5/LINUX-MINT-6.vmdk.dd.7z