Page 1

ARRAY & SERVER RECOVERY · A GUIDE FOR UK LAWYERS RAID, NAS and Server Recovery Reconstructing Arrays, Network Storage and Servers Without Losing the Evidence COMPUTER FORENSICS LAB

§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM NAS & VIRTUALISATION RECOVERY CPR PART 35 EXPERT REPORT S FULL CHAIN-OF-CUSTODY DOCUMENTATION

§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: the data is not on any one disk 03 How RAID, NAS and servers store data 04 Reconstructing an array: geometry, parity and forensic imaging 05 Failed and degraded arrays: recovery from partial sets 06 Preserving live server storage: snapshots, shares and proportionality 07 Deployment: disclosure, spoliation and the mishandled rebuild 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist

§ 01 · ORIENTATION Executive summary only when the array's geometry is correctly reconstructed, and the commonest way to lose it is a well-meant

§ 02 · FIRST PRINCIPLES The problem in plain English: the data is not on any one disk

§ 03 · HOWITSTORESDATA How RAID, NAS and servers store data MEMBERS GEOMETRY ARRAY FILE SYSTEM EVIDENCE