I'd like to introduce Hetman RAID Recovery, one of the tools we develop. It's a commercial data recovery application available for Windows, Linux, and macOS, and I'm directly involved in its development.

Our work focuses on understanding and reconstructing storage structures after hardware failures, accidental deletion, formatting, file system corruption, damaged RAID metadata, or the loss of access to encrypted storage.

We also conduct practical experiments using physical RAID controllers, NAS devices, servers, encrypted volumes, and virtual machines. I thought some of our work might be relevant to the digital forensics community, particularly when an investigation involves damaged or inaccessible storage.

Hardware RAID Reconstruction

One of our main development areas is reconstructing RAID arrays independently of their original controllers. The software examines RAID metadata on member disks to identify parameters such as:

• RAID level, member count, and original disk order.

• Stripe size, data offsets, and block order.

• Parity rotation, layout, and delay.

• Missing members and nested array structures.

• Controller-specific metadata.

Supported standard and nested configurations include JBOD, linear arrays, RAID 0, 1, 1E, 4, 5, 5E, 5EE, 6, 10, 01, 50, 51, 60, and 61.

When metadata is available, the RAID can be reconstructed automatically. If it is damaged or missing, our RAID Constructor provides automatic configuration searches, controller-specific presets, and manual configuration with a live preview of the resulting storage. The reconstruction is virtual and does not rebuild or write changes to the original member disks.

Screenshot: Manual RAID6 reconstruction with two missing drives

Hardware Controllers

Over the years, we've investigated recovery scenarios involving controllers from Dell PERC, HPE Smart Array, Broadcom/LSI MegaRAID, IBM ServeRAID, Adaptec, Areca, 3ware, Supermicro, Dawicontrol, and Infortrend.

Some specific controllers used in our lab experiments include:

• Dell PERC H700, PERC 6/i, and H310.

• HP Smart Array P410.

• IBM ServeRAID M5016.

• LSI MegaRAID 9265-8i, 9280-4i4e, and SAS 84016E.

• LSI 3ware 9650SE and 9750.

• Areca ARC-1210 and ARC-1260.

• Adaptec ASR-6405.

• Supermicro AOC-USAS-S8iR.

• Dawicontrol DC-624E.

• Infortrend EonStor ESDS 1012 RC.

We also support motherboard and host RAID implementations, including Intel RST/RSTe/VROC, AMD RAIDXpert/RAIDXpert2, and other supported metadata formats such as SNIA DDF.

These are different categories of support: some devices have been used in documented hands-on experiments, while others are supported through their known RAID metadata formats.

Linux, Windows and Software-Defined Storage

Our software is not limited to traditional hardware RAID.

Linux

Supported technologies include:

• Linux MD RAID, including RAID 0/1/4/5/6/10 and nested arrays.

• Linux LVM with physical volumes, volume groups, and logical volumes.

• LVM RAID 0/1/4/5/6/10, implemented directly through LVM.

• LVM-Thin, thin pools, logical volumes, and snapshots.

• LVM layered on top of MD RAID.

A particularly interesting case is LVM RAID6 combined with LUKS2 encryption and virtual machine storage.

Windows

Supported storage technologies include:

• Windows Dynamic Disks: spanned, striped, mirrored, and RAID5 volumes.

• Windows Storage Spaces: Simple, Mirror, and Parity layouts.

• Single- and dual-parity storage.

• Fixed and thin-provisioned virtual disks.

• Supported Storage Spaces Direct configurations.

NAS Systems

We work with storage configurations used by Synology, QNAP, NETGEAR ReadyNAS, Buffalo, TerraMaster, Thecus, Western Digital, Seagate, LaCie, and other manufacturers.

This includes Synology SHR-1/SHR-2, NETGEAR X-RAID, supported vendor-specific storage layouts, and Linux-based storage pools.

We've also worked with Unraid, OpenMediaVault, Rockstor, and TrueNAS storage environments.

The original NAS enclosure is not necessarily required. Member disks can be connected directly, acquired as disk images, or accessed over SSH when the storage system remains operational.

ZFS and Btrfs

ZFS and Btrfs deserve separate mention because their RAID implementations and storage structures differ from traditional controller-based RAID.

ZFS

Supported features include:

• Mirrors, RAIDZ1, RAIDZ2, RAIDZ3.

• dRAID1, dRAID2, dRAID3, including distributed spare capacity.

• Pools containing multiple supported vdevs.

• Datasets, snapshots, and clones.

• ZVOL block devices.

• Compression.

• Native ZFS dataset encryption, including supported AES-CCM/GCM configurations and password/keyfile unlocking.

Btrfs

Supported features include:

• RAID0/1/5/6/10 profiles.

• Multi-device file systems.

• Subvolumes and snapshots.

• Compressed data and different data/metadata allocation profiles.

Snapshots can be analyzed as historical states of a file system, including files that were modified or deleted after the snapshot was created.

Screenshot: Degraded dRAID2 with ZFS Native Encryption

This screenshot shows a detected dRAID2 configuration with two missing members and the dialog for unlocking a ZFS encrypted dataset using a password or keyfile.

Encrypted Storage

We have implemented support for several volume-level and file-level encryption technologies.

Encrypted Volumes

• BitLocker.

• VeraCrypt, including supported hidden-volume configurations.

• LUKS1 and LUKS2, including detached headers.

• Apple FileVault and encrypted APFS volumes.

• Legacy encrypted CoreStorage/HFS+ volumes.

• Native ZFS dataset encryption.

Encrypted Files and Virtual Disks

• Windows EFS.

• Linux fscrypt.

• Supported encrypted VMware virtual disks.

• Supported encrypted VirtualBox virtual disks.

These technologies can be encountered on individual drives, reconstructed RAID arrays, disk images, virtual disks, and supported snapshots.

Once a volume has been unlocked, the software can examine the underlying file system, including deleted files and surviving metadata.

We do not crack passwords or bypass encryption. The correct passwords, recovery keys, certificates/private keys, keyfiles, or other required credentials must be available.

We have also conducted controlled experiments involving VeraCrypt hidden volumes, BitLocker, LUKS2, encrypted APFS, and native ZFS encryption.

Forensic Images and Apple Disk Images

Another area we've been developing is direct analysis of disk-image containers without converting everything to RAW first.

Forensic Image Formats

Supported families include:

• EnCase / Expert Witness Format: E01, Ex01.

• SMART forensic images: S01.

• AFF and AFM.

• AFF Directory Images: AFD.

• AFF4 physical and directory-based containers.

The software can interpret supported segmented, multipart, and compressed image sets. Encrypted image variants can also be opened where the container implementation is supported and the necessary credentials are available.

Once mounted, an image is treated as a block-level storage source. It can contain partitions, encrypted volumes, file systems, RAID member data, or virtual disks.

Apple Disk Images

Supported Apple image formats include:

• DMG.

• CDR, TOAST, and ISO.

• Sparseimage.

• Sparsebundle.

• ASIF.

We also support encrypted DMG, Sparseimage, and Sparsebundle images. After successful unlocking, their contents can be analyzed for existing and deleted files.

Screenshot: Supported Forensic, Apple and Virtual Disk Image Formats

This is the image-mounting dialog in Hetman RAID Recovery 3.2, showing the forensic image, Apple image, and virtual machine disk categories.

An additional feature is the ability to combine physical disks, disk images, virtual disks, and remote block devices as sources during RAID reconstruction.

Virtual Machines and Snapshots

Virtualization is another major area of our recent work. Supported platforms and storage formats include:

• VMware Workstation / Fusion and ESXi/vSphere: VMDK, split/sparse disks, snapshots, and VMFS5/6.

• Microsoft Hyper-V: VHD, VHDX, AVHD, AVHDX, and checkpoints.

• Oracle VirtualBox: VDI and other supported virtual disk formats, encryption, and snapshots.

• Proxmox VE: RAW, QCOW2, VMDK, LVM, LVM-Thin, and ZFS-backed VM storage.

• KVM/QEMU: QCOW/QCOW2, RAW/IMG, COW, QED, and external snapshot chains.

• oVirt / Oracle Linux Virtualization Manager (OLVM): virtual disks, thin/thick provisioning, and snapshots.

• XenServer / XCP-ng: supported virtual disks and snapshots.

• FreeBSD bhyve: IMG and ZVOL-based virtual disks.

• Parallels Desktop and UTM.

• Virtual machine storage on Unraid and TrueNAS.

For supported snapshot chains, the software can reconstruct earlier disk states and examine their contents without starting the virtual machine.

We support both file-backed and block-backed virtual storage, including ZVOLs and LVM/LVM-Thin logical volumes.

This is useful when the original hypervisor is unavailable, the virtual machine has been deleted, or data needs to be recovered from a snapshot without reverting the running system.

Screenshot: Encrypted VirtualBox Disks and Snapshots

File Systems and File Recovery

After storage reconstruction, we use the file-system analysis capabilities of Hetman Partition Recovery. Supported file systems include:

• Windows: NTFS, ReFS, FAT, exFAT.

• Linux and Unix: Ext2/3/4, XFS, ReiserFS, Btrfs, ZFS, UFS.

• macOS: APFS and HFS+.

• VMware: VMFS5 and VMFS6.

• Specialized storage: HikvisionFS recognition and supported structure analysis.

File recovery uses surviving metadata, directory structures, journals, backup metadata, and content-based file signatures.

Depending on what remains intact, the software can reconstruct original paths, filenames, timestamps, deleted directories, and file contents.

For HikvisionFS, recognition of the proprietary structure should not be confused with guaranteed recovery of every recording format.

Additional Analysis Features

• Read-only analysis of the source storage.

• Sector-by-sector disk imaging.

• Built-in HEX editor.

• File and folder search.

• Preview of documents, images, video, archives, and other supported formats.

• Saving scan results for later analysis.

• Recovery to another physical or network destination.

• Remote block-device access over SSH.

Feedback from the Forensic Community

We're interested in feedback from practitioners dealing with damaged storage, encrypted evidence, uncommon RAID layouts, virtual machine snapshots, and complicated NAS configurations.

I'd particularly like to know:

• Which RAID controller or storage layout is difficult to analyze with your current tools?

• Are there forensic image variants or multi-layer encryption/storage configurations that deserve additional testing?

• Would detailed technical write-ups showing RAID metadata, reconstruction parameters, and recovery results be useful to this community?

I'm happy to discuss the technical details of our experiments, including cases where recovery does not work as expected.

Read the full article here: https://www.forensicfocus.com/articles/beyond-blur-decision-making-in-complex-licence-plate-examination-and-enhancement-casework/ 

Read the full article here: https://www.forensicfocus.com/articles/analyzing-driver-behavior-using-vehicle-data/ 

Read the full case study here: https://www.forensicfocus.com/case-studies/from-hours-to-minutes-accelerating-digital-investigations-with-detego-global-in-the-city-of-johannesburg/ 

Read the full case study here: https://www.forensicfocus.com/case-studies/msab-technology-helps-uncover-international-fraud-network-and-provides-answers-to-a-grieving-family/ 

Read the full case study here: https://www.forensicfocus.com/case-studies/msab-technology-helps-uncover-international-fraud-network-and-provides-answers-to-a-grieving-family/ 

Read the full article here: https://www.forensicfocus.com/articles/belkasoft-x-for-mobile-forensics-acquisition-analysis-and-reporting/

Watch the full webinar here: https://www.forensicfocus.com/webinars/roadblocks-ahead-navigating-the-major-issues-of-mobile-forensics/