This guide explains how to recover data from RAID, NAS, and server environments, detailing the reconstruction process without losing critical evidence.
Guide · 18 pages · 26 min read · Published 2026-08-31
Prepared by digital forensic and e-Discovery experts for UK lawyers, this comprehensive reference addresses the acute risk of evidence destruction on enterprise infrastructure where critical files do not reside on a single physical hard drive. It provides precise technical guidance on how multi-disk arrays, network-attached storage devices, and virtualised server environments structure data across member disks, detailing the exact forensic protocols needed to reconstruct array geometry, analyse parity, and secure bit-stream images from degraded or partially failed drive sets. The text aligns complex technical recovery with civil litigation requirements, explicitly addressing CPR Part 35 expert reporting standards, full chain-of-custody documentation, proportionality during live server snapshot acquisitions, and the prevention of spoliation caused by automated or mishandled array rebuilds. Beyond primary storage hardware, it maps wider evidentiary sources including cloud replicas, synced endpoint caches, and backups, while supplying litigators with practical drafting templates, interrogatories for opposing parties, red-flag checklists, and worked case examples to ensure recovered digital evidence remains legally admissible.
Read this guide on your phone, open the PDF reader with the full text, browse guides by topic or go back to the full PDF library.
18 pages · 26 min read
This guide for UK lawyers addresses the complexities of recovering data from RAID arrays, Network Attached Storage, and servers.
Published by Computer Forensics Lab on 2026-08-31. Original material of the practice, free to read, cite and download. See every guide's author and source.
Prefer a PDF that matches this page exactly? Download the current text as a PDF, generated from the current wording of the guide, including any later corrections.
ARRAY & SERVER RECOVERY · A GUIDE FOR UK LAWYERS RAID, NAS and Server Recovery Reconstructing Arrays, Network Storage and Servers Without Losing the Evidence COMPUTER FORENSICS LAB
§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM NAS & VIRTUALISATION RECOVERY CPR PART 35 EXPERT REPORT S FULL CHAIN-OF-CUSTODY DOCUMENTATION
§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: the data is not on any one disk 03 How RAID, NAS and servers store data 04 Reconstructing an array: geometry, parity and forensic imaging 05 Failed and degraded arrays: recovery from partial sets 06 Preserving live server storage: snapshots, shares and proportionality 07 Deployment: disclosure, spoliation and the mishandled rebuild 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist
§ 01 · ORIENTATION Executive summary only when the array's geometry is correctly reconstructed, and the commonest way to lose it is a well-meant
§ 02 · FIRST PRINCIPLES The problem in plain English: the data is not on any one disk
§ 03 · HOWITSTORESDATA How RAID, NAS and servers store data MEMBERS GEOMETRY ARRAY FILE SYSTEM EVIDENCE
§ 04 · RECONSTRUCTION Reconstructing an array: geometry, parity and forensic imaging
§ 05 · FAILEDANDDEGRADEDARRAYS Failed and degraded arrays: recovery from partial sets
§ 06 · PRESERVINGLIVESERVERSTORAGE Preserving live server storage: snapshots, shares and proportionality
§ 07 · DEPLOYMENT Deployment: disclosure, spoliation and the mishandled rebuild
§ 08 · THEWIDERMAP Source architecture: where else the evidence lives EVIDENCE ARRAY / (SYNCED/ COUNTERPARTS THE END POINT S SERVER CACHED) BACKUPS & CLOUD DELETED / REPLICAS PLATFORMS RECOVERABLE
§ 09 · IN THE WILD Worked examples EXAMPLE1 · THEHELPFULREBUILDTHATNEARLYLOSTTHECASE EXAMPLE2 · THENASINTHECUPBOARDANDTHEBACKUPTHATSAVEDIT EXAMPLE3 · THEVIRTUALISEDSERVERANDTHELAYEREDRECONSTRUCTION
§ 10 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations
§ 11 · INTERROGATORIES & DRAFTING AIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your e Discovery / forensic provider SUGGESTED WORDING · INSTRUCTIONFORANARR AY / SERVER RECOVERY
§ 12 · QUICK CONTROL Checklist and red flags · When to involve a digital forensic expert The array / server checklist Red flags When to involve a digital forensic expert
§ 13 · COMMON QUESTIONS Frequently asked questions Can you just image one disk from the server? A disk failed and IT put in a new one and rebuilt the array. Is the evidence gone? The array has lost two disks. Can it be recovered? Do we have to shut the business server down to preserve it? The whole array is huge. Do we really need to image all of it? Is a reconstructed array admissible as evidence?
§ 14 · REFERENCE Glossary Sources and authoritative references DISCLAIMER
§ HOW A SPECIALIST LABORATORY CAN ASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY
17 pages · 25 min read
iOS apps are individual worlds of evidence, each storing data uniquely.
19 pages · 26 min read
Deleted Android data often persists in SQLite free space and journals, recoverable until overwritten.
Whether you are responding to a regulator, preparing for disclosure, or scoping an internal investigation, start the chain of custody with a short, confidential conversation.
