Considering I have a 16Tb one for home use, I would expect larger ones to be quite common for enterprise use. And with 8Tb & 10Tb drives, a 80Tb solution is within SMB limits.
Ok ) , let's take your existing 16 Tb RAID (which I presume to be a Raid 0 out of 4x4 Tb disks or a 1+0 out of 4x8 Tb one).
How would you propose to image it?
Where/how would you store the image(s)?
jaclaz
Ok ) , let's take your existing 16 Tb RAID (which I presume to be a Raid 0 out of 4x4 Tb disks or a 1+0 out of 4x8 Tb one).
How would you propose to image it?
Where/how would you store the image(s)?
Actually it's Raid 5 (usable ~11Tb) 😉
This is exactly why I mentioned it. I think there should be a cost/benefit analysis of the potential evidence, and if it justifies the cost/time needed to image/recreate the entire thing, or document every step and do a live examination.
Actually it's Raid 5 (usable ~11Tb) 😉
How is it configured?
How many disks?
Which size each?
This is exactly why I mentioned it. I think there should be a cost/benefit analysis of the potential evidence, and if it justifies the cost/time needed to image/recreate the entire thing, or document every step and do a live examination.
Well, then it is Off Topic if someone asks "hOW TO MAKE RAID IMAGE".
Let us assume that the OP has the *need* to make an image (which is what was actually asked), and NOT a live examination, how to proceed, then?
jaclaz
How is it configured? How many disks? Which size each?
Qnap 4x4Tb Raid5
Well, then it is Off Topic if someone asks "hOW TO MAKE RAID IMAGE".
jaclaz
Since the initial question was not specific "..how to make forensic image of server RAID ,for both combination system and hardware raid..", I don't see how one can answer without considering the size/type of the said RAID. You could write a book and still not cover all the possibilities. So if I was asked I would answer it depends.
Anyway, here are a few articles to get started on RAID/NAS
How is it configured? How many disks? Which size each?
Qnap 4x4Tb Raid5
Good ) (which in this case means IMHO "bad") 😯 .
As a side-side note, and JFYI there are some theories about RAID 5 being not-so-ideal with such large disk drives, of course it depends on the type/quality of the actual single disks inside the thingy, but just in case
http//
Anyway, here are a few articles to get started on RAID/NAS
NAS Forensics Explained by belkasoft The Impact of RAID on Disk Imaging by NIST RAID Reassembly - A forensic Challenge
Last one being strangely similar to the one I posted initially. wink
jaclaz
Good ) (which in this case means IMHO "bad") 😯 .
As a side-side note, and JFYI there are some theories about RAID 5 being not-so-ideal with such large disk drives, of course it depends on the type/quality of the actual single disks inside the thingy, but just in case
http//www.raid-failure.com/Default.aspx
Well, three years later (since I got it) and with the WD 4Tb Red drives in it, it still rocks. I would prefer to set it up as RAID 6, but I would have lost a lot of valuable space so … cross your fingers that the post in your link is wrong )
Last one being strangely similar to the one I posted initially. wink
Actually it is the same link )