Making Complex Issues Simple: A Unique Method to Extract Data from RAID with Lost Configuration

No ratings

Presented at TechnoSecurity&DigitalForensics 2019 by

Mike Vysochin

Previously, only large enterprises have chosen RAID as storage media, now they are also commonly found among small companies and domestic users (e.g. home NAS). Therefore, it increases the possibility that RAID can be used in criminal activities and encountered by a digital forensics examiner. To gain access to data on RAID, it’s necessary not only to create a forensic image of each drive but also to assemble the array. But what if the service structures with the description of the configuration are damaged or lost? In such a case, the expert has to determine the correct configuration of a RAID out of thousands, or even millions of possible variants. During the session, attendees will discover technologies and practical methods which will make this hard work considerably easier and faster.