OSForensic - RAID rebuild limited to 4GB

[silmalik]

Hi,

Here by my issue while using Rebuilt RAID functionality:

I'm currently trying to rebuild an Intel matrix RAID 1 system from 2 disk images (1TB + 1TB = 2TB RAID).
One of the disks has is PCB burnt, so by swapping PCBs I was able to extract a raw image.

Setting up the RAID Rebuild function seems OK, Intel RAID is detected.

But, once the process started, the destination file grows up to 4GB and never beyond.
the process goes on, there is a disk activity and execution time seems ok (about 15hours).

I have monitored my system with Process Monitor and it shew that ofs64.exe write offset is reset once the limit (2^32) is reached.

Tried with 64bits & 32bits OSForensic binairies, same issue.

OSForensic 3.3 build 1002 (evaluation)
Windows 10.0 10.240 - 64bits
Images are 1To, expected RAID restoration size: 2TB.

Is it an evaluation limit, a known issue?

Thank you in advance.

[David (PassMark)]

It isn't a known issue, but we'll have a look at it.
It does sound like a bug.

[silmalik]

It isn't a known issue, but we'll have a look at it.
It does sound like a bug.

Ok, thank you for the feedback.

In the meantime, I've made a powershell script that did the rebuild job.
I'm able to mount the image result with OFSmount, file copy is in progress. That sounds good for my datas!

Thank you for the support and for letting some of your tools free to use.

[David (PassMark)]

We looked into it. It was a bug with large rebuilt destination drives. It will be corrected in the net OSForensics patch release (Version 3.3.1005)