This script is designed to locate and rebuild Apple software RAIDs.

The presence of these RAIDs may not always be obvious, which can lead the examiner to misinterpret the contents of their component partitions.

This script works by searching selected GUID Partition Table (GPT) disks for partitions having the following type-GUID, which signifies an Apple RAID partition:

• 52414944-0000-11AA-AA11-00306543ECAC.

A RAID’s partitions are referred to as its members. In the case of Apple RAIDs, each one has a header that is usually located in the last 4,096-bytes. This header contains the following information:

• A signature
• The GUID/UUID of the associated RAID
• The GUID/UUID of this member
• A bare-bones XML property-list stream containing the RAID’s configuration including:
• User-provided name (aka AppleRAID-SetName)
• RAID-type (aka AppleRAID-LevelName)
• Content-hint (aka AppleRAID-ContentHint)
• An array (aka list) of each member’s GUID/UUID (aka AppleRAID-Members)
• This member’s chunk-count (aka AppleRAID-ChunkCount)
• This member’s chunk-size (aka AppleRAID-ChunkSize)
  

Having found an Apple RAID partition, the script will attempt to validate the header by reading the aforementioned information. It will then endeavor to find the other RAID members.

At the conclusion of processing, the script will present a dialog box listing the complete RAIDs that have been found plus any that are invalid or incomplete. The user then has the option to rebuild one or more of the complete RAIDs.

It should be noted that:

• The script supports Stripe, Mirror and JBOD RAIDs.
• JBOD RAID’s are rebuilt using EnCase’s Span disk-configuration option.
• The script does not support nested RAIDs nor RAIDs implemented on non-GPT disks.
• The configuration of each rebuilt RAID can be inspected using EnCase’s Edit Disk Configuration option, which is to be found under the Evidence tab. The same option can be used to change the name of a rebuilt RAID, which will otherwise inherit the AppleRAID-SetName value.
• Rebuilt RAIDs that are unwanted can be removed using Evidence tab’s Remove option.
• Detailed feedback is provided via the console including the physical location of each member’s RAID header.
• The examiner also has the option of bookmarking all of the discovered RAID headers.

This script was developed for use in EnCase training. For more details, please click the following link:

• OpenText EnCase Training