NAS Evidence RAID Snapshots Shared Access Logs And Deleted Data

NASEVIDENCE · AGUIDEFORUKLAWYERS NAS Evidence: The Office Box That Holds Everything RAID, Snapshots, Shared Access, Logs and Deleted Data on Network- Attached Storage COMPUTERFORENSICSLAB § ABOUTTHEAUTHOR PRE PA REDBYCOMPUTERFORENSICSLABE - DISCOVERYTEAM FULL CHAIN-OF-CUSTODY DOCUMENTATION § CONTENTS In this guide 01 Executive summary 02 The problem in plain English: the box nobody documented 03 RAID in plain English: why the disks are not the data 04 Acquisition options: live, disks-out, or hybrid 05 What the appliance records: accounts, logs, snapshots, recycle folders 06 Source architecture: where else the evidence lives 07 Attribution on a shared box 08 Worked examples 09 Common mistakes and technical limitations 10 Questions to ask · Suggested wording 11 Checklist and red flags · When to involve a digital forensic expert 12 Frequently asked questions 13 Glossary · References · Disclaimer · How a specialist laboratory can assist § 0 1 · ORIENTATION Executive summary THEHEADLINEPOINT : TREATTHEAPPLIANCEASASMALLSERVERWITHBIGHABITS § 0 2 · FIRSTPRINCIPLES The problem in plain English: the box nobody documented § 0 3 · THEARRAY RAID in plain English: why the disks are not the data § 0 4 · GETTINGITOUT Acquisition options: live, disks-out, or hybrid § 0 5 · WHATTHEBOXREMEMBERS What the appliance records: accounts, logs, snapshots, recycle folders § 0 6 · THEWIDERMAP Source architecture: where else the evidence lives EVIDENCE NAS UNIT RELAY / REPLICA LOGS CLOUD USB / BACKUP BACKUP COUNTERPART DELETED / DEVICES RECOVERABLE § 0 7 · WHOSEHAND Attribution on a shared box § 0 8 · INTHEWILD Worked examples EXAMPLE1 · THERECYCLEBINNOBODYKNEWEXISTED EXAMPLE2 · THEDISKSINTHEWRONGORDER EXAMPLE3 · THEBOXWASGONE ; THEECOSYSTEMWASNOT § 0 9 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations § 1 0 · INTERROGATORIES & DRAFTINGAIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your eDiscovery / forensic provider SUGGESTEDWORDING · CLIENTHOLDINGINSTRUCTION ( SENDTO DAY ) § 1 1 · QUICKCONTROL Checklist and red flags · When to involve a digital forensic expert The NAS evidence checklist Red flags When to involve a digital forensic expert 35 report that reads the appliance's own records properly (Example 1), or the review that prices an opponent's § 1 2 · COMMONQUESTIONS Frequently asked questions One of the disks has failed. Is the data gone? The NAS is password-protected and the person who set it up has left. Now what? Files were deleted from the NAS months ago. Recoverable? Can we prove who deleted them? The unit also records our CCTV. Anything special to do? Is a home NAS different from an office one? § 1 3 · REFERENCE Glossary Sources and authoritative references DISCLAIMER § HOWASPECIALISTLABORATORYCANASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY