Forensics: Rebuilding a Windows RAID with EnCase

Rebuilding a Windows Striped RAID in EnCase is incredibly simple. This is because the information about the RAID is kept within the hard drives, as its a software RAID. This is not the case for a hardware RAID, as the information about the drive configuration .

Note – A video guide on how to rebuild a hardware RAID will be on  the Where is Your Data? YouTube Channel  later this month.

 

Step 1: Add the striped drives to the case

Adding Striped Drives to EnCase

Step2: Scan the disk configuration – right click one of the disks and select option (see screen shot)

Scan disk configuration with EnCase

Step 3: View the rebuilt RAID

Rebuilt RAID with EnCase

Advertisement