forensic image capt...
 
Notifications
Clear all

forensic image capturing to RAID 1 (mirrored) hard disks

18 Posts
8 Users
0 Likes
2,851 Views
(@adiamond)
Posts: 20
Eminent Member
Topic starter
 

Hi all.

I am new to the community and am very happy to find you all fellow forensics people.

We use Encase v6/v7 and FTK to perform forensic captures of source HDs. Typically, after a capture is made and verified, we will then make a backup/working copy of the HD.

My question is about RAID 1 mirroring as a way to simultaneously capture 2 (or more) copies of the same forensic image(s).

Using something like the below devices
Mediasonic http//www.amazon.com/Mediasonic-HF2-SU3S2-ProBox-Drive-Enclosure/dp/B003X26VV4/ref=pd_cp_e_3/190-9911345-6478833
Guardian Maximus http//eshop.macsales.com/shop/firewire/usb/raid_1/Gmax

I believe this would work in theory, but I was curious as to whether any of you have had any experience doing something like this.

In theory, once you have verified one copy (the RAID primary drive), you *should* be reasonably confident that you will have a sound secondary copy from the RAID array. However, I anticipate that one would be best off to also remove the secondary disk from the RAID array and verify it separately.

I would love to have anyone's thoughts about this.

Many thanks,

Anthony

 
Posted : 07/08/2012 7:13 am
jhup
 jhup
(@jhup)
Posts: 1442
Noble Member
 

Are you saying you would 'mirror' the evidence drive to a blank drive using RAID?

Where would the RAID information be written for the evidence drive to properly function?

Or, are you saying using these devices as target for the storage of images?

 
Posted : 07/08/2012 8:14 am
(@adiamond)
Posts: 20
Eminent Member
Topic starter
 

Are you saying you would 'mirror' the evidence drive to a blank drive using RAID?

Where would the RAID information be written for the evidence drive to properly function?

Or, are you saying using these devices as target for the storage of images?

Hi, jhup.

I would use the devices as target for the storage of images.

My goal would be to capture the forensic image to the RAID array of 2 drives configured in RAID 1 mirrored mode. The RAID array would appear to the capturing station as 1 drive. In the background, the RAID controller would simultaneously make an exact "mirrored" copy of the data. So, at the end of the imaging process, you would have two exact copies of the captured forensic image.

Thanks!

 
Posted : 07/08/2012 8:23 am
Adam10541
(@adam10541)
Posts: 550
Honorable Member
 

Xways forensics (I think) now has the functionality to output an image to two separate hard drives to give you two images of the same source drive.

Might be far simpler to implement this than using RAID arrays to duplicate data that can be done more efficiently in other way. The cost of Xways is not prohibitive either so may even be a cheaper option and then you end up with another fully fledged forensic suite to add to the tool kit.

 
Posted : 07/08/2012 8:27 am
(@adiamond)
Posts: 20
Eminent Member
Topic starter
 

Xways forensics (I think) now has the functionality to output an image to two separate hard drives to give you two images of the same source drive.

Might be far simpler to implement this than using RAID arrays to duplicate data that can be done more efficiently in other way. The cost of Xways is not prohibitive either so may even be a cheaper option and then you end up with another fully fledged forensic suite to add to the tool kit.

Hi, Adam10541.

Than you. Yes, I'm aware that there are plenty of tools that can forensically capture to multiple targets. In fact, we already use the Tableau (sp) TD2 which can do this.

However, I'm just interested to know if the RAID option will work. I have other reasons for wanting to know this. It will fit better into our existing workflow and equipment plan. Plus, these RAID enclosures are rather cheap and can serve other functions (that we are interested in) as well.

I'm taking a look at Xways site as well. I'd not heard of them until now. Thanks much.

Anthony

 
Posted : 07/08/2012 8:32 am
jhup
 jhup
(@jhup)
Posts: 1442
Noble Member
 

How will the drives function as stand-alone drives?

 
Posted : 08/08/2012 7:32 am
jhup
 jhup
(@jhup)
Posts: 1442
Noble Member
 

How will the drives function as stand-alone drives?

 
Posted : 08/08/2012 7:35 am
(@adiamond)
Posts: 20
Eminent Member
Topic starter
 

How will the drives function as stand-alone drives?

Initially, when capturing to them, they will function as a RAID 1 array, but once they are taken out of the RAID enclosure, they will function as individual drives with identical data.

 
Posted : 08/08/2012 9:12 am
KungFuAction
(@kungfuaction)
Posts: 109
Estimable Member
 

Hardware RAID is much faster and more reliable than software-based RAID. So an eSATA dual bay dock/enclosure with RAID 1 should fit the bill nicely, such as this item

http//bit.ly/OLUucQ

It's worth the $25.94 if you're willing to take a small gamble at this setup.

 
Posted : 08/08/2012 6:11 pm
(@c-r-s)
Posts: 170
Estimable Member
 

No problem, I'm using DAWICONTROL RAID modules as a multiplier for image deployment to up to five drives per channel
http//www.dawicontrol.com/index.php?cmd=proddet&id=stomo (unfortunately no English documentation)

For forensic purposes I'd recommend individual verification.

 
Posted : 09/08/2012 3:27 am
Page 1 / 2
Share: