This guide, 'RAID, NAS and Server Recovery', is prepared by Computer Forensics Lab for UK lawyers, in-house counsel, and investigators.
Guide · 18 pages · 26 min read · Published 2026-08-31
This guide, 'RAID, NAS and Server Recovery', is prepared by Computer Forensics Lab for UK lawyers, in-house counsel, and investigators. It addresses the complexities of reconstructing arrays, network storage, and servers without losing evidence. The guide covers how RAID, NAS, and servers store data, the process of reconstructing an array, and recovery from failed or degraded arrays. It also discusses preserving live server storage, deployment considerations like disclosure and spoliation, and where else evidence might live within source architecture. Practical sections include common mistakes, technical limitations, questions to ask, and a checklist of red flags, advising when to involve a digital forensic expert for array or server recovery.
Read this guide on your phone, browse guides by topic or go back to the full PDF library.
18 pages · 26 min read
This guide, 'RAID, NAS and Server Recovery', is prepared by Computer Forensics Lab for UK lawyers, in-house counsel, and investigators.
Published by Computer Forensics Lab on 2026-08-31. Original material of the practice, free to read, cite and download. See every guide's author and source.
Prefer a PDF that matches this page exactly? Download the current text as a PDF, generated from the wording shown here, including any later corrections.
ARRAY & SERVER RECOVERY · A GUIDE FOR UK LAWYERS RAID, NAS and Server Recovery Reconstructing Arrays, Network Storage and Servers Without Losing the Evidence COMPUTER FORENSICS LAB
§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM NAS & VIRTUALISATION RECOVERY CPR PART 35 EXPERT REPORT S FULL CHAIN-OF-CUSTODY DOCUMENTATION
§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: the data is not on any one disk 03 How RAID, NAS and servers store data 04 Reconstructing an array: geometry, parity and forensic imaging 05 Failed and degraded arrays: recovery from partial sets 06 Preserving live server storage: snapshots, shares and proportionality 07 Deployment: disclosure, spoliation and the mishandled rebuild 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist
§ 01 · ORIENTATION Executive summary only when the array's geometry is correctly reconstructed, and the commonest way to lose it is a well-meant
§ 02 · FIRST PRINCIPLES The problem in plain English: the data is not on any one disk
§ 03 · HOWITSTORESDATA How RAID, NAS and servers store data MEMBERS GEOMETRY ARRAY FILE SYSTEM EVIDENCE
§ 04 · RECONSTRUCTION Reconstructing an array: geometry, parity and forensic imaging
§ 05 · FAILEDANDDEGRADEDARRAYS Failed and degraded arrays: recovery from partial sets
§ 06 · PRESERVINGLIVESERVERSTORAGE Preserving live server storage: snapshots, shares and proportionality
§ 07 · DEPLOYMENT Deployment: disclosure, spoliation and the mishandled rebuild
§ 08 · THEWIDERMAP Source architecture: where else the evidence lives EVIDENCE ARRAY / (SYNCED/ COUNTERPARTS THE END POINT S SERVER CACHED) BACKUPS & CLOUD DELETED / REPLICAS PLATFORMS RECOVERABLE
§ 09 · IN THE WILD Worked examples EXAMPLE1 · THEHELPFULREBUILDTHATNEARLYLOSTTHECASE EXAMPLE2 · THENASINTHECUPBOARDANDTHEBACKUPTHATSAVEDIT EXAMPLE3 · THEVIRTUALISEDSERVERANDTHELAYEREDRECONSTRUCTION
§ 10 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations
§ 11 · INTERROGATORIES & DRAFTING AIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your e Discovery / forensic provider SUGGESTED WORDING · INSTRUCTIONFORANARR AY / SERVER RECOVERY
§ 12 · QUICK CONTROL Checklist and red flags · When to involve a digital forensic expert The array / server checklist Red flags When to involve a digital forensic expert
§ 13 · COMMON QUESTIONS Frequently asked questions Can you just image one disk from the server? A disk failed and IT put in a new one and rebuilt the array. Is the evidence gone? The array has lost two disks. Can it be recovered? Do we have to shut the business server down to preserve it? The whole array is huge. Do we really need to image all of it? Is a reconstructed array admissible as evidence?
§ 14 · REFERENCE Glossary Sources and authoritative references DISCLAIMER
§ HOW A SPECIALIST LABORATORY CAN ASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY
19 pages · 26 min read
17 pages · 25 min read
Whether you are responding to a regulator, preparing for disclosure, or scoping an internal investigation, start the chain of custody with a short, confidential conversation.
