Often on RAID systems an entire volume can be reconstructed if the Level 4 (dedicated parity drive) or Level 5 (block interleaved distributed parity) areas of the entire logical volume are available (Miller, 2007). Often forensic investigators will begin with these inherent advantages of the RAID technology, yet revert to virtualization techniques if these do not work (Leventhal, 2010). RAID is by nature a technology that can replicate list partitions and drives (Elerath, 2009) (Leventhal, 2010) (Miller, 2007).
Isolating which data has been lost and then defining a strategy for its recovery is critically important in the development of forensics strategies for reconstructing and recovering it (Miller, 2007). RAID techniques have proven to be exceptionally effective in reconstructing lost data, yet the use of virtualization techniques have augmented and accelerated greater forensic success rates of recovery (Teelink, Erbacher, 2006).
Conclusion
Initiating strategies for the recovery of...
Our semester plans gives you unlimited, unrestricted access to our entire library of resources —writing tools, guides, example essays, tutorials, class notes, and more.
Get Started Now