jhup wrote:
As Adam said, in my experience a RAID 1 is not byte-by-byte identical.
It cannot be, specially if it is a hardware RAID, in my reconstructing experience.
...
From the digital forensics perspective, I would locate the discrepancies, and note it. I venture to say if you hashed the volumes, they will be identical. The reference data should be written somewhere outside (one would hope), of at least volumes, but preferably outside of partitions.
Thanks for this contribution. It's a little unfortunate that we've had to make the assumption that it was RAID 1, with no further details on the observations, however, I suppose that's the nature of a public forum.
I agree, logic dictates there may be differences between the disks, while the volumes should hash identically. For what it's worth, I just double-checked drive image capture reports on a case I'm working that involves a RAID 1, and in this instance, each disk produced the same hash value. The only difference between the disks was the serial number. Conclusion: as with many forensic issues, your mileage may vary.
↧