OSForensics™ can rebuild a single RAID image from a set of physical disk images belonging to a RAID array. Being able to properly image systems with RAID configurations for forensics analysis is sometimes challenging, due to the fact that having access to the RAID parameters (such as the RAID level and stripe size) that were used may not be possible. The following RAID levels are supported:
- RAID 0
- RAID 1
- RAID 3
- RAID 4
- RAID 5
- RAID 0+1
- RAID 1+0
Once the RAID parameters are known, they can be used to rebuild the RAID logical image.
Detect RAID parameters
When the member disk images are added, OSForensics will try to automatically configure the RAID parameters. These RAID parameters are obtained from the metadata that is stored in the disk image, which can also be viewed in OSForensics. The following RAID metadata formats may be detectable by OSForensics:
- Intel Matrix RAID
- Linux mdadm RAID
- SNIA DDFv1
- Highpoint v2 RocketRAID
- Highpoint v3 RocketRAID
- Adaptec HostRAID
- Integrated Technology Express RAID
- JMIcron RAID
- LSILogic V2 MegaRAID
- LSILogic V3 MegaRAID
- nVidia MediaShield
- Promise FastTrak
- Silicon Image Medley RAID
- Silicon Integrated Systems RAID
- VIA Tech V-RAID
