Page 1
ARRAY & SERVER RECOVERY · A GUIDE FOR UK LAWYERS RAID, NAS and Server Recovery Reconstructing Arrays, Network Storage and Servers Without Losing the Evidence COMPUTER FORENSICS LAB
§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM NAS & VIRTUALISATION RECOVERY CPR PART 35 EXPERT REPORT S FULL CHAIN-OF-CUSTODY DOCUMENTATION
§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: the data is not on any one disk 03 How RAID, NAS and servers store data 04 Reconstructing an array: geometry, parity and forensic imaging 05 Failed and degraded arrays: recovery from partial sets 06 Preserving live server storage: snapshots, shares and proportionality 07 Deployment: disclosure, spoliation and the mishandled rebuild 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist
§ 01 · ORIENTATION Executive summary only when the array's geometry is correctly reconstructed, and the commonest way to lose it is a well-meant
§ 02 · FIRST PRINCIPLES The problem in plain English: the data is not on any one disk
§ 03 · HOWITSTORESDATA How RAID, NAS and servers store data MEMBERS GEOMETRY ARRAY FILE SYSTEM EVIDENCE
Page 2
§ 04 · RECONSTRUCTION Reconstructing an array: geometry, parity and forensic imaging
§ 05 · FAILEDANDDEGRADEDARRAYS Failed and degraded arrays: recovery from partial sets
§ 06 · PRESERVINGLIVESERVERSTORAGE Preserving live server storage: snapshots, shares and proportionality
§ 07 · DEPLOYMENT Deployment: disclosure, spoliation and the mishandled rebuild
§ 08 · THEWIDERMAP Source architecture: where else the evidence lives EVIDENCE ARRAY / (SYNCED/ COUNTERPARTS THE END POINT S SERVER CACHED) BACKUPS & CLOUD DELETED / REPLICAS PLATFORMS RECOVERABLE
§ 09 · IN THE WILD Worked examples EXAMPLE1 · THEHELPFULREBUILDTHATNEARLYLOSTTHECASE EXAMPLE2 · THENASINTHECUPBOARDANDTHEBACKUPTHATSAVEDIT EXAMPLE3 · THEVIRTUALISEDSERVERANDTHELAYEREDRECONSTRUCTION
Page 3
§ 10 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations
§ 11 · INTERROGATORIES & DRAFTING AIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your e Discovery / forensic provider SUGGESTED WORDING · INSTRUCTIONFORANARR AY / SERVER RECOVERY
§ 12 · QUICK CONTROL Checklist and red flags · When to involve a digital forensic expert The array / server checklist Red flags When to involve a digital forensic expert
§ 13 · COMMON QUESTIONS Frequently asked questions Can you just image one disk from the server? A disk failed and IT put in a new one and rebuilt the array. Is the evidence gone? The array has lost two disks. Can it be recovered? Do we have to shut the business server down to preserve it? The whole array is huge. Do we really need to image all of it? Is a reconstructed array admissible as evidence?
§ 14 · REFERENCE Glossary Sources and authoritative references DISCLAIMER
§ HOW A SPECIALIST LABORATORY CAN ASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY
Cite as: Joseph Naghdi, RAID NAS And Server Recovery, Computer Forensics Lab, https://e-discovery.uk/library/raid-nas-and-server-recovery/pdf.