O'Reilly logo

Computer Evidence: Collection and Preservation, Second Edition by Christopher L. T. Brown

Stay ahead with the world's most comprehensive technology and business learning platform.

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, tutorials, and more.

Start Free Trial

No credit card required

Large System Imaging Methodologies

One of the first questions asked by investigators entering into a corporate network is, “How do I effectively bit-stream image a RAID array?” Looking back at Chapter 8, “SAN, NAS, and RAID,” investigators will recall that RAID technology combines multiple disks (32 or more) and represents them as one or more logical volumes of the attached system. Because the RAID system can be implemented with software by network operating systems (NOSs) such as Windows Server products and Linux or hardware RAID controllers, the reassembly of the RAID disk for analysis could require specialized software or hardware, not to mention all the system downtime caused by removing each disk of a RAID array and imaging one disk at a ...

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, interactive tutorials, and more.

Start Free Trial

No credit card required