Imaging technique using a NAS

Is it best to copy the image files from the External HD unto a back up server? - sovietpeacker

The prevailing thought is that it is better to backup to several disks (RAID) rather than to a single disk. The redundancy of RAID 5, for example, allows for 1 disk to fail while still preserving all the data. The single disk storage solution allows no room for failure.

Also is it advisable to reuse those external HDs to image again? - sovietpeacker

As long as you have what you believe is a good backup of your data (images, etc.), you should be able to re-use those external HDD. It would be a good idea to forensically wipe those drives before using them again.

If you get a great number of cases with a large number of imaged systems would you consider tape storage of the image files? - sovietpeacker

As for tape drives, I don't have any experience with them (though I'm looking to purchase one for my agency), but it seems like a solid solution for archiving your data once the case is closed. My understanding is they can be slower than hard drives, so I probably wouldn't use them for actively processing cases.

On the topic of hard drives, this article discusses reliability for certain hard drive models https://www.backblaze.com/blog/hard-drive-stats-for-2017/. One model has a nearly 30% failure rate. Ouch. I would probably consider a model other than that one.

Thanks Tacobreath. Very well explained reply.

I am actually thinking of suggesting we get a large server to store case images, as you suggested, a RAID5 setup would be ideal in order to ensure fault tolerance.

Now, would you consider it necessary to perform some sort of verification/validation once the data is copied to the server to ensure the copied image has been copied without any issues?

That's a good question. Obviously you want to ensure the hash (MD5, SHA1, etc.) value of your image file remains the same when copied to another device. But there are quite a few options for coping over the other files related to your case, such as your forensic reports, notes, etc., that don't require verifying the integrity of the file. One free option we use is TeraCopy. It will give you a list of files it could not copy or move, allowing you to troubleshoot the process. You could spend a little money and get a decent solution for your needs.

A great resource for many of these situations is Josh Moulin's website at https://www.joshmoulin.com/category/digital-forensics/. He covers setting up a digital forensics lab environment, among other things.