• Intel Software RAID
• JMicron JMB36x
• LSI Logic MegaRAID
• NVidia NForce
• Promise FastTrack
• Silicon Image Medley
• VIA Software RAID
RAID detection information is always shown in the drive tile for a given drive,
regardless of the viewing location within the user interface and what type of RAID is
detected. Any available detailed RAID information is provided in the Drive Details
view, but that information depends on which type of RAID system the drive is from.
Whatever information is available and displayed in the Drive Details screen is also
captured in the forensic log for any job that involves a detected RAID drive.
Note: RAID information is detected on both source and destination drives. In the
case of a clone of an SNIA DDF RAID source drive, there is a technical detail to be
aware of that is of forensic importance. This RAID type stores its RAID identification
information relative to the end of the drive. If the clone job did not utilize the Trim
feature (to add a DCO to the destination to make its size match that of the source
drive), then the new destination clone will not be detected as an SNIA DDF RAID
drive. For this reason, it is highly recommended to use the Trim feature when cloning any
RAID source drive. Also, note that a related issue can occur in the case of an SNIA
DDF RAID drive that was repurposed for use as a standard destination drive. In that
case, if the destination drive was not wiped before use, it will inaccurately show as
an SNIA DDF RAID drive, since the original RAID identification information would
still be stored at the end of the drive. Besides being good standard practice, for SNIA
DDF RAID detection purposes, it is highly recommended that destination drives be wiped
before use as a forensic destination drive.
The sample screenshots below show how two different types of RAID drives are
shown in the Sources drive list and the Drive Details screens.
4.10. Viewing sources and destinations
ISTX240300-UGD-EN-1
User Guide
179
To Next Page
Loading...
