Page 1
N AS EVIDENCE · A GUIDE FOR UK LAWYERS NAS Evidence: The Office Box That Holds Everything RAID, Snapshots, Shared Access, Logs and Deleted Data on Network- Attached Storage COMPUTER FORENSICS LAB
§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM FULL CHAIN-OF-CUSTODY DOCUMENTATION
§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: the box nobody documented 03 RAID in plain English: why the disks are not the data 04 Acquisition options: live, disks-out, or hybrid 05 What the appliance records: accounts, logs, snapshots, recycle folders 06 Source architecture: where else the evidence lives 07 Attribution on a shared box 08 Worked examples 09 Common mistakes and technical limitations 10 Questions to ask · Suggested wording 11 Checklist and red flags · When to involve a digital forensic expert 12 Frequently asked questions 13 Glossary · References · Disclaimer · How a specialist laboratory can assist
§ 01 · ORIENTATION Executive summary THE HEADLINE POINT: TREATTHEAPPLIANCEASASMALLSERVERWITHBIGHABITS
§ 02 · FIRST PRINCIPLES The problem in plain English: the box nobody documented
§ 03 · THEARRAY RAID in plain English: why the disks are not the data
Page 2
§ 04 · GETTINGITOUT Acquisition options: live, disks-out, or hybrid
§ 05 · WHATTHEBOXREMEMBERS What the appliance records: accounts, logs, snapshots, recycle folders
§ 06 · THEWIDERMAP Source architecture: where else the evidence lives EVIDENCE NAS UNIT RELAY / REPLICA LOGS CLOUD US B / BACKUP BACKUP COUNTERPART DELETED / DEVICES RECOVERABLE
§ 07 · WHOSE H AND Attribution on a shared box
§ 08 · IN THE WILD Worked examples EXAMPLE1 · THERECYCLEBINNOBODYKNEWEXISTED EXAMPLE2 · THE DISK S IN THE WRONG ORDER EXAMPLE3 · THEBOXWASGONE; THEECOSYSTEMWASNOT
§ 09 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations
Page 3
§ 10 · INTERROGATORIES & DRAFTING AIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your e Discovery / forensic provider SUGGESTED WORDING · CLIENT HOLD IN G INSTRUCTION ( SENDTO DAY )
§ 11 · QUICK CONTROL Checklist and red flags · When to involve a digital forensic expert The NAS evidence checklist Red flags When to involve a digital forensic expert 35 report that reads the appliance's own records properly (Example 1), or the review that prices an opponent's
§ 12 · COMMON QUESTIONS Frequently asked questions One of the disks has failed. Is the data gone? The NAS is password-protected and the person who set it up has left. Now what? Files were deleted from the NAS months ago. Recoverable? Can we prove who deleted them? The unit also records our CCTV. Anything special to do? Is a home NAS different from an office one?
§ 13 · REFERENCE Glossary Sources and authoritative references DISCLAIMER
§ HOW A SPECIALIST LABORATORY CAN ASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY
Cite as: Joseph Naghdi, NAS Evidence RAID Snapshots Shared Access Logs And Deleted Data, Computer Forensics Lab, https://e-discovery.uk/library/nas-evidence-raid-snapshots-shared-access-logs-and-deleted-data/pdf.