NAS · RAID · member drives · reassembly · shared storage · company data
NAS and RAID forensics. Shared company storage spreads the data across several drives; it must be reassembled before it can be read.
A NAS box or a RAID array is where a business often keeps its shared data, and so where the evidence in a company dispute frequently sits, but it presents a particular challenge: the data is spread across several drives and interleaved, so no single drive holds readable files. The array must be reassembled before anything can be examined. We image each member drive behind a write blocker, reconstruct the array in software from the images, and then examine the reassembled data for the artefacts and files the matter turns on. Because the number of drives and the configuration vary, a NAS or RAID examination is quoted on its facts rather than at the single-disk rate.
Rather talk it through? An engineer answers the bench line
0800 6890668
How a NAS or RAID is examined.
A NAS or RAID stores data across multiple drives for capacity or resilience, striping and interleaving it so that a single drive holds only fragments. To examine the data, the array has to be reassembled, which means working out the configuration, the number of drives, the layout, the order, and reconstructing the whole from the parts.
We image each member drive individually behind a write blocker and hash it, then reconstruct the array in software from the images, never from the original drives. Once the array is reassembled, the data, the shared files, the folders, the deleted items, is examined as it would be on any volume, for the artefacts and evidence the matter requires.
Because the configuration and the number of drives vary, a NAS or RAID examination is quoted on the configuration, not charged at the single-disk rate. Our sister services cover NAS and RAID data recovery in depth; for a forensic matter we add the chain of custody, the integrity record and the reporting.
What to know for this exhibit.
From the exhibit arriving to the report.
Work we have closed →The first conversation, and the authority check Free
Tell us the situation, who owns the device, and what you need to know. We tell you whether it is a job we can take on, what authority we will need, and whether the standard report answers your questions or an expert report is called for. That conversation is free, and some enquiries end there, because we will not take work we cannot lawfully or honestly do.
Imaging behind a write blocker, and the hashes
When the exhibit arrives, your authority is checked, the device is logged and photographed, and the drive is connected through a hardware write blocker and imaged bit for bit. MD5 and SHA-256 hashes of the source and the image are computed and verified, so the copy is provably identical. Nothing is examined on the original; every later step is done on the verified image.
The examination, on the image
The image is examined for the artefacts your questions turn on: USB device history, files opened from removable media, cloud and webmail activity, deleted files and the Recycle Bin, the USN journal, program execution, email, document metadata, shadow copies, and a timeline. Findings that matter are confirmed in a second tool. The work is scoped to what you asked; material outside the scope is not reproduced.
The report
The standard forensic report sets out the exhibit and its condition, the integrity record, the tools and method, and the findings by category, with a timeline, the limitations, and factual conclusions, as a self-contained report with its chain-of-custody and case-log reports. It is written in plain terms, keeps fact separate from any comment, and is suitable for internal decisions, HR processes, negotiations and solicitors. Where you need opinion evidence for court, an expert report is quoted.
Before you send it
- Send all the member drives; the array cannot be reassembled without them, labelled by bay if you can.
- Do not try to rebuild the array yourself; a failed rebuild can make reconstruction harder.
- Preserve the system as it is; note the make and model and the drive order if you know it.
A RAID interleaves data across several drives, so it must be reassembled from images of every member before any file can be read.
What helps, and what harms.
Do this much first
- Stop using the device and keep it powered off
- Preserve it as it is; record who has held it
- Gather your proof of ownership or authority
- Tell us the situation and the questions you have
What sets us back
- Letting anyone open it to have a look
- Reinstalling, wiping or running recovery software
- Carrying on using the device
- Sending us a mobile phone; they are not examined
Questions answered before you instruct.
Can you examine a NAS or RAID forensically?
Yes. We image each member drive behind a write blocker, reconstruct the array in software from the images, and examine the reassembled data for the artefacts and files your matter turns on, with a full integrity record. Send all the member drives, labelled by bay if you can.
Why does a RAID cost more than a single disk?
Because the data is spread across several drives and interleaved, so the array has to be reassembled before anything can be examined, which means imaging every member and reconstructing the whole in software. The work scales with the number of drives and the configuration, so it is quoted on its facts.
Do you need all the drives?
Yes, or at least enough of them to reconstruct the array, which depends on the configuration. Send all the member drives; the more complete the set, the more reliable the reconstruction. Labelling them by bay helps.
What will it show?
Once reassembled, the shared data is examined like any volume, for the files, folders, deletions and artefacts the matter requires. The report is a factual account, with the limits stated.
What does it cost?
A NAS or RAID examination is quoted on the configuration and the number of drives, rather than at the single-disk rate. The first conversation is free, and we will give you a figure once we know the setup.
Preserve it, and let us image it first.
The first conversation is free. Tell us the exhibit and the situation, and who owns it, and we will tell you what can be examined, what authority we need, and whether we can take it on. Until then, stop using it and preserve it as it is.