Forensics: Rebuilding a Windows RAID with EnCase

Rebuilding a Windows Striped RAID in EnCase is incredibly simple. This is because the information about the RAID is kept within the hard drives, as its a software RAID. This is not the case for a hardware RAID, as the information about the drive configuration .

Note – A video guide on how to rebuild a hardware RAID will be on  the Where is Your Data? YouTube Channel  later this month.

 

Step 1: Add the striped drives to the case

Adding Striped Drives to EnCase

Adding Striped Drives to EnCase

Step2: Scan the disk configuration – right click one of the disks and select option (see screen shot)

Scan disk configuration with EnCase

Scan disk configuration with EnCase

Step 3: View the rebuilt RAID

Rebuilt RAID with EnCase

Rebuilt RAID with EnCase

Advertisements

One Response to “Forensics: Rebuilding a Windows RAID with EnCase”

  1. Raid forensics | Stunningevents Says:

    […] Forensics: Rebuilding a Windows RAID with EnCase « Where is …Forensics: Rebuilding a Windows RAID with EnCase. May 9, 2009 — 585. Rebuilding a Windows Striped RAID in EnCase is incredibly simple. This is because … […]


Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

%d bloggers like this: