Digital forensic investigation methodology for Storage Space: Based on the NIST digital forensic process

Junho Kim, Sangjin Lee, Doowon Jeong

Research output: Contribution to journalArticlepeer-review

Abstract

For forensic examiners, investigating the RAID systems of servers has been challenging, as the examiners must reconstruct multiple high-capacity disks to identify digital evidence. Software-based RAID systems’ use has been released for personal use, so examiners should consider RAID systems even when they investigate personal computers. Although there is a high probability that the software-based RAID will become a target of crime, there has been little research into digital forensic methodology for software-based RAID, as exemplified by Storage Space. In this paper, we introduce details about the structure of Storage Space found through reverse engineering. Storage Space was analyzed by applying the digital forensic process of NIST. We explain how to reconstruct a virtual disk configured using Storage Space and develop an automated tool to do so. To evaluate our study and the tool developed, we created an experimental scenario and describe in detail the forensic procedure and technical methods for the analysis of Storage Space. Our research can be used as the basis of forensic investigations for Storage Space.

Original languageEnglish
Pages (from-to)989-1001
Number of pages13
JournalJournal of Forensic Sciences
Volume67
Issue number3
DOIs
Publication statusPublished - 2022 May

Keywords

  • RAID forensics
  • RAID reconstruction
  • Storage Space
  • digital forensics
  • software-based RAID
  • windows forensics

ASJC Scopus subject areas

  • Pathology and Forensic Medicine
  • Genetics

Fingerprint

Dive into the research topics of 'Digital forensic investigation methodology for Storage Space: Based on the NIST digital forensic process'. Together they form a unique fingerprint.

Cite this