CFChiTown wrote:
I'm limited in my RAID knowledge. I've used them in a server farm before, but not really looked at many forensically, hence my confusion about the drives would look like individual in EnCase. Normally if I have a RAID, it's a machine that is in my possession and I can rebuild it with Encase.
That's nicely symmetrical as I have NO idea how a single disk form a RAID 5 setup can look in Encase. <img src="images/smiles/icon_eek.gif" alt="Shocked" title="Shocked" />
What I know is that a single disk taken outside a RAID 5 array is normally seen as a bunch of "random" data, as stripes are "disseminated" over several disks (+ parity) as seen here:
http://www.adaptec.com/en-us/_common/compatibility/_education/raid_level_compar_wp.htm#2.3a
jaclaz
↧