So, let's try to find the required parameters for a simple unknown RAID 5.

Its known parameters are:
1. Number of disks: Three
2. File System: NTFS (created by Windows XP/2003 and later using a standard Master Boot Record (MBR start block)
3. Type: Basic volume

Its unknown parameters that must be found are:
1. Disk order
2. Block size 3
3. Block order
4. Disk offset

The RAID disks are represented as image files created in R-Studio:
Disk1.arc
Disk2.arc
Disk3.arc

Click image to enlarge
Image files of RAID components

Please note that even though R-Studio has found a Disk1 object on Disk2.arc, that does not necessarily indicate that this is the first disk in the RAID.


Finding Master Boot Record
First we need to find the MBR to determine a RAID offset.
1. One after another, open all the tree image files in the Text/hexadecimal editor.
2. Do not enable write to prevent accidental data corruption in the objects being edited!
3. Write down the Windows disk signature for each object to recognize later which Editor's window belongs to which object.
4. Search for the MBR start block. On the Search dialog box, enter 33 C0 8E D0 BC (this is a standard MBR start block, but in some cases it may be different) into the HEX field; then select From start position and enter 0 in Search at offset.
5. Click OK to start searching.

Data in Search dialog box to begin search for the Master Boot Record (MBR)

Search results:

Click image to enlarge
Disk1.arc opened in the Text/hexadecimal editor


Click image to enlarge
Disk2.arc opened in the Text/hexadecimal editor. MBR pattern found.


Click image to enlarge
Disk3.arc opened in the Text/hexadecimal editor. MBR pattern found.

The result is that the Text/hexadecimal editor finds this pattern at address 00 on Disk2.arc and Disk3.arc; Disk1.arc shows only zeros. That means that the offset is 0, and Disk1.arc cannot be the first disk in the RAID.

Meanwhile, the Editor correctly recognized those patterns on Disk2 and Disk3 as master bootstrap loader code. In our case, two disks have the same MBR data on the same place.

Now, as a second step, we need to find the NTFS boot sector.
Take a look on the Sectors preceding partition field on the Template pane

Template pane for Disk2 and Disk3

For our case, the sector preceding the partition is 16,065.

If this value is larger than 63, we should divide it by N -1, where N is the number of disks (in our case, N = 3), which gives us 8,032. This is an approximate position to start searching for the NTFS boot sector. We will start the search from this position to avoid finding false NTFS boot sectors that may remain from previous NTFS partitions.

Jump to that sector in the Editor and then search for the NTFS boot sector pattern.

The Sectors search field in the Text/hexadecimal editor

On the Search dialog box, enter EB 52 90 4E 54 46 53 20 20 20 20 (the NTFS boot sector always starts from these bytes) into the HEX field, select From current position and enter 0 in Search at offset.

Data in Search dialog box to start search for NTFS boot sector

The Editor finds this pattern at sector 8064 on Disk2 and Disk3.

Now select the Boot sector NTFS pattern on the Template pane.

Click image to enlarge
Disk2.arc opened in the Text/hexadecimal editor. NTFS boot sector pattern found. The same pattern is found on Disk3.arc.

Required parameters that we have found
Bytes per sector: 512
Sectors per cluster: 8
Logical Cluster Number for the file $MFT: 786432

Previously found parameters:
RAID offset: 0

Next we need to find the MFT (master file table) on the disk:

1. We will try to find an approximate MFT offset from the RAID start:
MFT offset from the partition start in sectors = Logical Cluster Number for the file $MFT * Sectors per cluster+RAID offset = 786,432*8+0 = 6,291,456
If the RAID offset is not 0, we need to add the offset to the result of the equation above.
MFT start on the first disk = MFT offset from the partition start in sectors/(N-1) = 6,291,456/2 = 3,145,728

2. We will begin to search for the exact MFT start at a position a couple thousand sectors less than this value. Say, sector 3,140,000.
On the Search dialog box, enter "FILE" into the ANSI field, then select From current position and enter 0 in Search at offset.

This pattern is found at sector 10,241,463 on Disk2 and at sector 3,153,792 on Disk3.


First file record sector in Disk3. Start of a data block.

What is important: The signature FILE ends with 0, which means that the file record number is not overwritten with a fixup. If it had ended with * (FILE*), we would not have been able to proceed further in our search and would have needed to use another technique.

The pattern $.M.F.T. (HEX 24 00 4D 00 46 00 54) shows that this is a correct MFT beginning.
Because sector 3,153,792 is closer to our expected value of sector 3,145,728 than to sector 10,241,463, we may assume that Disk3 is the first disk in the RAID.

To proceed further, we need to keep in mind that a file record in MFT occupies two sectors, and that data is written to a RAID 5 successively, one data block to one disk, then the next data block to the next disk, and a parity block to the third disk. We can represent an example of such a scheme in the following table ...