Page 1

N AS EVIDENCE · A GUIDE FOR UK LAWYERS NAS Evidence: The Office Box That Holds Everything RAID, Snapshots, Shared Access, Logs and Deleted Data on Network- Attached Storage COMPUTER FORENSICS LAB

§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM FULL CHAIN-OF-CUSTODY DOCUMENTATION

§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: the box nobody documented 03 RAID in plain English: why the disks are not the data 04 Acquisition options: live, disks-out, or hybrid 05 What the appliance records: accounts, logs, snapshots, recycle folders 06 Source architecture: where else the evidence lives 07 Attribution on a shared box 08 Worked examples 09 Common mistakes and technical limitations 10 Questions to ask · Suggested wording 11 Checklist and red flags · When to involve a digital forensic expert 12 Frequently asked questions 13 Glossary · References · Disclaimer · How a specialist laboratory can assist

§ 01 · ORIENTATION Executive summary THE HEADLINE POINT: TREATTHEAPPLIANCEASASMALLSERVERWITHBIGHABITS

§ 02 · FIRST PRINCIPLES The problem in plain English: the box nobody documented

§ 03 · THEARRAY RAID in plain English: why the disks are not the data