«  
  »
November 30th, 2008 by ahoog

RAID

Redundant Array of Inexpensive Disks (RAID) is a storage technology that combines multiples physical hard drives into a logical drive with various goals in mind including performance, reliability or scalability.

In computer forensics, you will often encounter RAID arrays on large server installs.  Due to the complicated nature of RAID and the fact that most arrays need to stay online, RAID setups are often forensically imaged “logically” so you have a copy of the data on the array but not a forensic image of every drive.

The most common forms of RAID used today are:

  • RAID 0 (striping) has no fault tolerance and is built for performance, using each disk in its entirety
  • RAID 1 (mirroring) reads/writes to two disks at the same time, providing redundancy but little to no performance increases
  • RAID 5 uses 3 or more disks and spreads the data over the entire array.  One full disk of capacity is lost to allow for redundancy and thus it the array will not experience data loss if 1 drive fails.  RAID 5 is, perhaps, the most common form of RAID as it combines performance increases with reliability
  • RAID 6 is similar to RAID 5 but can survive the loss of 2 drives.  However, more drive capacity is lost for parity and thus is more expensive
  • RAID 10 (or 1+0) is a combination of a set of striped disks (RAID 0) which is then logically combined and mirrored

When RAID was invented, hard drives were much smaller in capacity and if a single hard drive in an array was lost it could be fairly easily rebuilt.  However, today hard drive capacities exceed 1TB and as such one’s RAID implementation may need updating.  There is an interesting discussion about the “death of RAID5″ and below are a few relevant links:

  • Share/Bookmark
November 30th, 2008 | Category: Computer Forensics Glossary

You must be logged in to post a comment.