RAID and NAS Forensics

What it is and why it matters

Offices put their shared files on a NAS. Servers put their databases on RAID. In both cases the data is striped, mirrored or parity-protected across several physical disks, and no single disk holds a readable file system. Pull one drive, image it and you have a slice of a picture with no edges.

The forensic approach is to image every member disk individually through a write-blocker, never to let the original controller rebuild or repair anything, and then to reconstruct the array in software from the images. For that the examiner must work out the RAID level, the stripe size, the order of the disks, the parity rotation and any offset where the data starts. Hardware controllers, Linux mdadm, Windows Storage Spaces and the proprietary layouts used by NAS makers all do this differently.

A NAS is also a small computer. Its operating system, usually Linux-based, keeps user accounts, share permissions, access logs, snapshots and sometimes a recycle bin for the shares. These records can show who opened what and when, which the file system alone cannot.

Types of digital evidence

Reconstructed File Systems
The ext4, Btrfs, XFS, NTFS or ZFS volume that appears once the array is rebuilt, with all its files, metadata and deleted content.
RAID Metadata
Superblocks and controller headers on each disk that record the array layout, member order, creation time and the last time each disk was part of the set.
NAS System Logs
Operating system logs, authentication records and the appliance's own event history, showing logins, share access, configuration changes and disk events.
Share Access Records
SMB, NFS and FTP logs where enabled, linking a client address and account to the files it opened or deleted.
Snapshots and Versioning
Btrfs or ZFS snapshots and NAS recycle bins that preserve earlier versions of files and copies of deleted ones.
User and Permission Configuration
Local accounts, directory service links and share permissions that show who could reach which data.
Stale Member Disks
A disk dropped from the array earlier, which carries an older snapshot of the data as it stood when it left.

Devices and data sources

Two-bay and four-bay NAS appliances in small offices and homes
Rack-mounted NAS and SAN units in company server rooms
Servers with hardware RAID controllers and battery-backed cache
Linux software RAID (mdadm) and LVM volumes
Windows dynamic disks and Storage Spaces pools
Vendor layouts such as Synology Hybrid RAID and QNAP storage pools
DVR and NVR units with several disks configured as a set
iSCSI targets and virtual disks hosted on the NAS
Spare and failed disks kept in a cupboard next to the array

How an examination runs

The order matters. Each step protects the one after it.

01
Document the Array in Place
Photograph the unit, the bay numbering and each disk in its slot before removing anything. Record the controller or NAS model, firmware and any status lights or on-screen messages.
02
Capture Configuration Live if Possible
If the system is running and authority allows, record the RAID configuration, volume layout and NAS settings from its interface. This saves hours of guessing later.
03
Image Every Member Disk
Remove the disks, label each with its slot, and image each one separately through a write-blocker. Hash each image. Never connect a member disk to a controller that might rebuild or resync it.
04
Read the Metadata
Look for mdadm superblocks, controller headers or vendor metadata on each image to learn the level, stripe size, order and offset. Note the event counters that show which disk is stale.
05
Reconstruct Virtually
Assemble the array from the images in forensic software or a Linux examination system in read-only mode. If the metadata is missing, work out the parameters from the data itself using known file structures.
06
Verify the Reconstruction
Check that the file system mounts cleanly, that large files such as videos or archives are intact and that parity checks agree. A wrong disk order shows as corrupted files at stripe boundaries.
07
Examine Volume and Appliance
Analyse the file system as usual, then parse the NAS operating system partitions for logs, users, shares and snapshots.
08
Report the Layout
State the RAID parameters found, how they were verified and the treatment of any stale or missing disk, so the reconstruction can be repeated.

Tools used in this discipline

Independent profiles: what each tool does, where it stops and what you need to know before using it.

Browse the full tools directory

Terminology

RAID Level: The scheme used across the disks. RAID 0 stripes with no redundancy, RAID 1 mirrors, RAID 5 stripes with one parity block per stripe, RAID 6 with two, RAID 10 mirrors stripes.
Stripe Size: The amount of data written to one disk before the controller moves to the next. Common values are 64 KB to 1 MB. Getting it wrong scrambles every file larger than one stripe.
Parity Rotation: The pattern in which the parity block moves between disks from stripe to stripe. Left or right, symmetric or asymmetric. Different controllers use different patterns.
Disk Order: Which physical disk holds which position in the stripe. Bay numbering does not always match logical order, so it is checked against the data.
Degraded Array: A redundant array running with one disk missing or failed. The data is readable but a second failure loses it. The examiner reconstructs it in software without any rebuild.
Superblock: The metadata record Linux mdadm writes on each member disk describing the array. It includes an event counter that shows whether a disk is up to date.
Stale Disk: A member that left the array before the others. Its contents are older, and mixing it into a reconstruction corrupts the result.
Storage Pool: A layer above RAID on many NAS systems where volumes are carved from the combined space. Pools can span arrays and use Btrfs or LVM on top.
iSCSI LUN: A block device exported over the network by the NAS, often a large file or thin volume. Inside it sits another file system that must be parsed separately.

Challenges and limits

What makes it hard

Vendor-specific layouts and metadata formats are not fully documented and change with firmware versions
A single wrong parameter in stripe size, order or offset produces a reconstruction that looks almost right but has corrupted files
Degraded arrays with a stale disk tempt the examiner to include it, which mixes old and new data
Imaging many large disks takes days, and the reconstruction doubles the storage needed
Encrypted volumes on the NAS, or self-encrypting drives in the array, leave the reconstruction unreadable without the key
Hardware controller caches may hold unwritten data that is lost when the unit is powered down
Snapshots and thin provisioning scatter a file's blocks in ways that defeat simple carving

Keeping the evidence intact

Label every disk with its bay number before removal and keep that mapping with the images
Image each disk through a write-blocker and never attach a member to a controller or NAS that might resync it
Hash each disk image and each reconstructed volume image separately
Record every reconstruction parameter and the checks used to verify it so another examiner can rebuild the same volume
Treat the NAS operating system partitions as evidence too and image them with the data disks

Standards and legal considerations

ISO/IEC 27037:2012
Acquisition and preservation guidance that applies to each member disk and to the appliance as a whole.
Read the guide
NIST SP 800-86
The forensic process reference, including the handling of servers and storage in an incident.
Read the guide
SWGDE Best Practices
SWGDE guidance on computer forensic acquisition and on the documentation expected for complex storage.
Read the guide
ISO/IEC 27042:2015
Guidance on the analysis and interpretation of digital evidence, which matters when a reconstruction must be shown to be correct.
Read the guide

In practice

A Four-Bay NAS After a Resignation
A design firm believes a partner deleted project files from the office NAS before leaving. The examiner images all four disks, reads the mdadm superblocks to confirm a RAID 5 set and its order, reconstructs the ext4 volume and finds the files in a Btrfs snapshot taken the night before the deletion. The NAS access log shows the partner's account deleting the folder.
The Disk in the Cupboard
A server's RAID 5 array has three disks in the chassis and one on a shelf. The event counters show the shelf disk dropped out months earlier. The examiner reconstructs the array from the three current members and examines the stale disk separately as a snapshot of the older data.
Stripe Size by Trial
A hardware RAID 0 controller has died and its metadata format is unknown. The examiner locates a large video file whose structure is known, tests stripe sizes and orders until the file plays end to end, then applies those parameters to the whole volume and documents the method.

This page is educational material, not legal advice. Laws and standards change, commence on different dates and are interpreted differently across jurisdictions. Always read the official text linked on this page and take advice from a qualified professional for a real matter.

Learn it at DFRTI

Free pages explain. These courses teach it on real devices with a mentor.

StorageDigital Storage ForensicsRAID / NAS ForensicsImage RAID members, rebuild arrays virtually and examine NAS boxes after ransomware.AdvancedDCFA

StorageDigital Storage ForensicsHDD ForensicsImage hard drives through a write-blocker, find hidden areas and recover deleted data.IntermediateDCFA

StorageDigital Storage ForensicsFile System AnalysisRead NTFS, FAT, exFAT, ext4 and APFS at the structure level and build timelines.IntermediateDCFA

MalwareIncident Response & Malware AnalysisRansomware & Threat ResponseHandle a ransomware attack from first call to recovery, reporting and lessons learnt.IntermediateMalware Analyst

Careers that use it

Data Recovery Specialist

Questions people ask

Can I just plug the disks into another NAS of the same model?

Not for forensic work. The new unit may resync, rebuild or write its own metadata to the disks, changing the evidence. Image each disk and reconstruct in software.

What if one disk is missing or dead?

A RAID 5 or RAID 6 array can be reconstructed with one or two members missing because the parity fills the gap. A RAID 0 array cannot. The report states which disk was absent and what that meant.

How do I know the reconstruction is correct?

Mount the file system read-only and check that large files with known structure, such as videos, archives and databases, are intact from start to end. Corruption at regular intervals points to a wrong stripe size or order.

Does the NAS keep a record of who deleted a file?

Often, if logging was enabled. Many NAS systems log share access by account and address, and some keep a recycle bin and snapshots. These are part of the examination alongside the data volume.