RAID NAS And Server Recovery

ARRAY & SERVERRECOVERY · AGUIDEFORUKLAWYERS RAID, NAS and Server Recovery Reconstructing Arrays, Network Storage and Servers Without Losing the Evidence COMPUTERFORENSICSLAB § ABOUTTHEAUTHOR PRE PA REDBYCOMPUTERFORENSICSLABE - DISCOVERYTEAM NAS & VIRTUALISATION RECOVERY CPR PART 35 EXPERT REPORTS FULL CHAIN-OF-CUSTODY DOCUMENTATION § CONTENTS In this guide 01 Executive summary 02 The problem in plain English: the data is not on any one disk 03 How RAID, NAS and servers store data 04 Reconstructing an array: geometry, parity and forensic imaging 05 Failed and degraded arrays: recovery from partial sets 06 Preserving live server storage: snapshots, shares and proportionality 07 Deployment: disclosure, spoliation and the mishandled rebuild 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist § 0 1 · ORIENTATION Executive summary only when the array's geometry is correctly reconstructed, and the commonest way to lose it is a well-meant § 0 2 · FIRSTPRINCIPLES The problem in plain English: the data is not on any one disk § 0 3 · HOWITSTORESDATA How RAID, NAS and servers store data MEMBERS GEOMETRY ARRAY FILE SYSTEM EVIDENCE § 0 4 · RECONSTRUCTION Reconstructing an array: geometry, parity and forensic imaging § 0 5 · FAILEDANDDEGRADEDARRAYS Failed and degraded arrays: recovery from partial sets § 0 6 · PRESERVINGLIVESERVERSTORAGE Preserving live server storage: snapshots, shares and proportionality § 0 7 · DEPLOYMENT Deployment: disclosure, spoliation and the mishandled rebuild § 0 8 · THEWIDERMAP Source architecture: where else the evidence lives EVIDENCE ARRAY / (SYNCED/ COUNTERPARTS THE ENDPOINTS SERVER CACHED) BACKUPS & CLOUD DELETED / REPLICAS PLATFORMS RECOVERABLE § 0 9 · INTHEWILD Worked examples EXAMPLE1 · THEHELPFULREBUILDTHATNEARLYLOSTTHECASE EXAMPLE2 · THENASINTHECUPBOARDANDTHEBACKUPTHATSAVEDIT EXAMPLE3 · THEVIRTUALISEDSERVERANDTHELAYEREDRECONSTRUCTION § 1 0 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations § 1 1 · INTERROGATORIES & DRAFTINGAIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your eDiscovery / forensic provider SUGGESTEDWORDING · INSTRUCTIONFORANARR AY / SERVERREC OV ERY § 1 2 · QUICKCONTROL Checklist and red flags · When to involve a digital forensic expert The array / server checklist Red flags When to involve a digital forensic expert § 1 3 · COMMONQUESTIONS Frequently asked questions Can you just image one disk from the server? A disk failed and IT put in a new one and rebuilt the array. Is the evidence gone? The array has lost two disks. Can it be recovered? Do we have to shut the business server down to preserve it? The whole array is huge. Do we really need to image all of it? Is a reconstructed array admissible as evidence? § 1 4 · REFERENCE Glossary Sources and authoritative references DISCLAIMER § HOWASPECIALISTLABORATORYCANASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY