Title: 6. Performing RAID Data Acquisitions
Course: IN 2005 Digital Forensics > Section: Module 4: Chapter 4 - Data Acquisition

Performing RAID Data Acquisitions

1. Size is the biggest concern because many RAID systems are now pushing into many terabytes of data.

Understanding RAID

1. Redundant array of independent (formerly “inexpensive”) disks (RAID) as a computer configuration involving two or more disks that was originally developed as a data-redundancy measure.
2. See Figures 4-11 through 4-14 that explains all different RAID levels, similarities and differences and advantages and disadvantages:
  - RAID 0
  - RAID 1
  - RAID 2
  - RAID 3
  - RAID 4
  - RAID 5
  - RAID 6
  - RAID 10
  - RAID 15

Acquiring RAID Disks

1. The main concerns when acquiring RAID disks, including:
  - How much data storage is needed?
  - What type of RAID is used?
  - Do you have the right acquisition tool?
  - Can the tool read a forensically copied RAID image?
  - Can the tool read split data saves of each RAID disk?
2. Older hardware-firmware RAID systems can be a challenge when you’re making an image.
3. Some of the vendors offering RAID acquisition functions, including:
  - Technologies Pathways ProDiscover
  - Guidance Software EnCase
  - X-Ways Forensics
  - Runtime Software
  - R-Tools Technologies
4. Occasionally, a RAID system is too large for a static acquisition.  Retrieving only the data relevant to the investigation with the sparse or logical acquisition method is the practical solution.