Identifying electronic evidence from a damaged RAID server

Rate this item
(0 votes)

After our client’s mail server stored on a RAID-5 was maliciously damaged by one of their employees, we were instructed by their solicitor to conduct a full forensic examination of the evidence. It was suspected that the server’s hard drives were concealing inappropriate correspondence. The hard drives had been removed and the circuit boards, physically destroyed. To exasperate the situation, backups had been securely erased and could not be retrieved.

Our technicians removed the RAID server from site to ensure preservation of the evidence. Before acquisition and analysis could begin, it was necessary to render the hard drives serviceable in order to take an exact sector level duplicate. We are one of the few computer forensic experts that also specialise in data recovery. The hard drives were dismantled in our clean room and rebuilt using donor parts.

We were then asked to establish whether or not there was sufficient evidence to show that activity was performed during a seven day window and whether the evidence of this activity had been forensically wiped (in addition to physical destruction of the hard disk drives in the RAID). Our data recovery engineers then imaged all the repaired hard drives in the RAID array, taking care to maintain the integrity of the evidence and adhering to Association of Police Chief Officers (ACPO) guidelines at all times.

Thankfully there was no media damage to the platters and we were able to image the drives without error. The acquired images were verified using hash functions and the data parameters calculated in order to rebuild the data on the server.

The main tools used were AccessData Forensic Toolkit FTK and FTK Imager. The data recovered clearly identified signatures for forensic wiping programs, namely CCleaner and DiskWipe, which are used to clean hard drives and to destroy data permanently. Using powerful forensic data recovery tools, we were able to recover all the data and then search for specific activity by keyword and text string. Needless to say, there was a wealth of inappropriate activity that had been cloaked by the perpetrators. Our subsequent forensic report was presented to an employment tribunal which resulted in an successful outcome for our client.

Reference: http://www.datarecoveryspecialists.co.uk/blog/identifying-electronic-evidence-from-a-damaged-raid-server
Data Recovery Expert

Viktor S., Ph.D. (Electrical/Computer Engineering), was hired by DataRecoup, the international data recovery corporation, in 2012. Promoted to Engineering Senior Manager in 2010 and then to his current position, as C.I.O. of DataRecoup, in 2014. Responsible for the management of critical, high-priority RAID data recovery cases and the application of his expert, comprehensive knowledge in database data retrieval. He is also responsible for planning and implementing SEO/SEM and other internet-based marketing strategies. Currently, Viktor S., Ph.D., is focusing on the further development and expansion of DataRecoup’s major internet marketing campaign for their already successful proprietary software application “Data Recovery for Windows” (an application which he developed).

25 comments

  • Comment Link Cooper Monday, 13 November 2017 19:26 posted by Cooper

    Appreciation to my father who stated to me regarding this weblog, this blog is
    actually amazing.

  • Comment Link Clifton Monday, 13 November 2017 03:43 posted by Clifton

    This post will help the internet visitors for setting up new webpage or even a blog from start
    to end.

  • Comment Link Deanne Thursday, 09 November 2017 16:13 posted by Deanne

    Thanks for sharing your thoughts on drives. Regards

  • Comment Link Margareta Friday, 03 November 2017 05:26 posted by Margareta

    I am sure this post has touched all the internet people, its
    really really good article on building up new web site.

  • Comment Link Bennett Wednesday, 01 November 2017 13:15 posted by Bennett

    bookmarked!!, I really like your website!

  • Comment Link Jamal Wednesday, 01 November 2017 01:51 posted by Jamal

    Hi mates, pleasant paragraph and fastidious urging commented at
    this place, I am genuinely enjoying by these.

  • Comment Link Emelia Tuesday, 31 October 2017 05:28 posted by Emelia

    That is a very good tip particularly to those new to
    the blogosphere. Short but very precise information… Thanks for sharing
    this one. A must read article!

  • Comment Link Ingeborg Tuesday, 31 October 2017 04:40 posted by Ingeborg

    Howdy! This is my first comment here so I just wanted to
    give a quick shout out and tell you I genuinely enjoy
    reading through your posts. Can you recommend any other blogs/websites/forums that deal with the same subjects?

    Thanks a ton!

  • Comment Link Jacob Monday, 23 October 2017 03:24 posted by Jacob

    Heya i'm for the primary time here. I found this board and I
    in finding It truly helpful & it helped me out much. I hope to provide one thing back and help others like you helped me.

  • Comment Link Luca Sunday, 22 October 2017 22:31 posted by Luca

    You can certainly see your enthusiasm within the
    work you write. The world hopes for more passionate writers such as you who are not afraid to say
    how they believe. All the time go after your heart.

Leave a comment

Make sure you enter the (*) required information where indicated. HTML code is not allowed.