Often on RAID systems an entire volume can be reconstructed if the Level 4 (dedicated parity drive) or Level 5 (block interleaved distributed parity) areas of the entire logical volume are available (Miller, 2007). Often forensic investigators will begin with these inherent advantages of the RAID technology, yet revert to virtualization techniques if these do not work (Leventhal, 2010). RAID is by nature a technology that can replicate list partitions and drives (Elerath, 2009) (Leventhal, 2010) (Miller, 2007).
Isolating which data has been lost and then defining a strategy for its recovery is critically important in the development of forensics strategies for reconstructing and recovering it (Miller, 2007). RAID techniques have proven to be exceptionally effective in reconstructing lost data, yet the use of virtualization techniques have augmented and accelerated greater forensic success rates of recovery (Teelink, Erbacher, 2006).
Initiating strategies for the recovery of lost data can be successful only when the inherent advantages of RAID technology are combined with the use of data virtualization technologies (Teelink, Erbacher, 2006). Creating more effective approaches to recovering data needs to begin with an in-depth knowledge of RAID technologies followed with expertise in data visualization and recovery.
Elerath, J. (2009). Hard-Disk Drives: The Good, the Bad, and the Ugly. Association for Computing Machinery. Communications of the ACM, 52(6), 38.
Hafner, J., Deenadhayalan, V., Belluomini, W., & Rao, K. (2008). Undetected disk errors in RAID arrays. IBM Journal of Research and Development,
52 (4/5), 413-425.
Leventhal, A.. (2010). Triple-Parity RAID and Beyond. Association for Computing Machinery. Communications of the ACM, 53(1), 58.
Ron Miller. (2007,.