Digital forensic investigation methodology for Storage Space: Based on the NIST digital forensic process

Junho Kim, Sangjin Lee, Doowon Jeong

    Research output: Contribution to journalArticlepeer-review

    1 Citation (Scopus)

    Abstract

    For forensic examiners, investigating the RAID systems of servers has been challenging, as the examiners must reconstruct multiple high-capacity disks to identify digital evidence. Software-based RAID systems’ use has been released for personal use, so examiners should consider RAID systems even when they investigate personal computers. Although there is a high probability that the software-based RAID will become a target of crime, there has been little research into digital forensic methodology for software-based RAID, as exemplified by Storage Space. In this paper, we introduce details about the structure of Storage Space found through reverse engineering. Storage Space was analyzed by applying the digital forensic process of NIST. We explain how to reconstruct a virtual disk configured using Storage Space and develop an automated tool to do so. To evaluate our study and the tool developed, we created an experimental scenario and describe in detail the forensic procedure and technical methods for the analysis of Storage Space. Our research can be used as the basis of forensic investigations for Storage Space.

    Original languageEnglish
    Pages (from-to)989-1001
    Number of pages13
    JournalJournal of Forensic Sciences
    Volume67
    Issue number3
    DOIs
    Publication statusPublished - 2022 May

    Bibliographical note

    Publisher Copyright:
    © 2022 American Academy of Forensic Sciences.

    Keywords

    • RAID forensics
    • RAID reconstruction
    • Storage Space
    • digital forensics
    • software-based RAID
    • windows forensics

    ASJC Scopus subject areas

    • Pathology and Forensic Medicine
    • Genetics

    Fingerprint

    Dive into the research topics of 'Digital forensic investigation methodology for Storage Space: Based on the NIST digital forensic process'. Together they form a unique fingerprint.

    Cite this