How to Acquire RAIDs (EnCase)

Hardware RAID acquired as one volume


A hardware raid is a group of hard drives connected to a physical RAID controller that is integrated into the motherboard, or as an add-on card. The RAID controller translates the information from multiple drives into one large physical drive. Because of the large number of variations that the RAID controller can have, it is easiest to acquire the RAID as one large physical disk instead of acquiring the drives separately and trying to piece them together in EnCase. To acquire the RAID as one large volume requires that you acquire that RAID in its native environment, as seen by the RAID controller:

1. 1.Open the case of the suspect computer and document the RAID setup. Leave the cover open because you will need access to the hard drives later on.
   
2. 2.Download and create a Network boot disk (Because it contains many popular SCSI drivers and also supports parallel port and network crossover acquisitions)
   
3. 3.Unplug the power and data connectors to each hard drive (Noting where they were connected because we will need to reconnect later)
   
4. 4.Boot the suspect computer and configure the BIOS to boot to floppy only.
   
5. 5.Save the settings and power down the computer
   
6. 6.Reconnect the hard drives in the same way that they were connected in Step 4.
   
7. 7.If performing a DOS Drive to Drive acquisition, Connect your partitioned and FAT-32 formatted storage drive to a spare hard drive connector on the suspect computer. If there are no more connectors, you may use one from the CD-ROM drive, or connect it to an add-on IDE controller card and insert the controller card into a free PCI slot on the motherboard.
   
8. 8.Now insert your boot floppy and boot the computer using it. If you are working with a SCSI RAID array, choose the options to Auto Detect and load the SCSI drivers using the network boot disk. If you intend to perform a network crossover acquisition, allow the computer to detect and load drivers for the network card.
   
9. 9.Launch EnCase® for DOS. Remember, the BIOS sees the RAID as one drive, so you will only see one large physical drive in EnCase.
   
10. 10.Acquire the RAID array as you would acquire a single IDE hard drive. 
11. When the acquisition is finished, the RAID array will appear as one physical disk in EnCase.

Hardware RAID acquired as multiple disks

Sometimes acquiring the disk configuration as one drive is not possible or impractical due to time constraints. When you reconstruct a Hardware RAID array that has been acquired as separate drives, it is referred to as editing disk configuration in EnCase. To edit disk configuration, several items of information are required:

• *Stripe size
• *Start sector
• *Length per physical disk
• *Right or Left handed stripe
• *What order the physical disks are in

Usually you can collect this information from the BIOS of the controller card.


To acquire and build a hardware disk configuration:

1. 1.Open the case of the suspect computer and document the RAID setup. Leave the cover open because you will need access to the hard drives for the next step
   
2. 2.Acquire each disk in the RAID.
3. 3.Add the evidence files from all of the RAID disks to one case.
   
4. 4.Switch to the Devices tab. (Select VIEW -> Cases -> DEVICES)
   
5. 5.Right-click on any of the evidence file rows and select Edit Disk Configuration... from the contextual menu
   
   
   
   Right-click for pop-up menu, left-click for command
   
   
6. 6.You will then see the "Disk Configuration" dialog box
   
   
   
   Disk Configuration settings
   
   
7. 7.Right click in the empty Component Devices window and choose New
   
   
   
   Adding / Editing a disk element in the RAID
   
   
8. 8.Highlight the first disk and enter the start sector and element size.
   
9. 9.Click OK
   
10. 10.Repeat steps 5-7 for each disk in the RAID, making sure that they are added in correct numerical order.
    
11. 11.Next, select the type of RAID in the Disk Configuration List Box
    
12. 12.Set the Stripe Size, Choose if the image is of a physical disk, and choose if it is a right-handed stripe set and Click OK
    
    
    
    Choosing the RAID Array parameters
    
    
13. 13.You will now see the newly created RAID device in the devices view
    
    
    
    New RAID device
    
    
14. 14.When you go to the Cases/Entries view and expand the RAID array, you will see the folder structure of the RAID array
    
    
    
    The rebuilt RAID
    
    

Software RAID

Software RAIDs are simply a series of hard drives controlled by the operating system (as opposed to a RAID controller card) to be written to and read from as a RAID. The BIOS of the host computer, therefore, sees the drives as separate drives, because it is the OS, not the BIOS, that is making the RAID. They are separate drives, and seen as separate drives, so you have to acquire them as separate drives. It is important to note that the OS cannot reside on the software RAID, so it will reside on a separate disk. The disk that contains the OS also contains the registry, which contains the necessary information to rebuild the RAID, so always make sure that you acquire this disk as well.

1. 1.Open the case of the suspect computer and document the RAID setup. Leave the cover open because you will need access to the hard drives for the next step
   
2. 2.Acquire each disk in the RAID (including the non-RAID disk that contains the OS files).
3. 3.Add all of the evidence files into one case.
   
   
   
   Case with all drives added
   
   
4. 4.Note that in the Cases/Entries view, the members that make up the software RAID have the RAID/Dynamic Disk icon instead of the physical disk icon.
   
5. 5.Right click on the hard drive contains the OS files and choose Scan Disk Configuration.
   
6. 6.EnCase will locate the appropriate information needed and rebuild the RAID
   
   
   
   Software RAID added to case
   
   

Additional Methods to acquire RAIDs

Dave Shaver of the US Army Computer Crime Investigative Unit has provided a presentation on how to acquire the following types of RAIDs:

• *Intel-Based Hardware RAID (Dead)
• *Intel-Based Hardware RAID (Live)
• *Linux Software RAID (Live)
• *Linux Software RAID (Dead)
• *Windows Software RAID (Live)
• *Windows Software RAID (Dead)
• *Unix Non-Intel RAID (Live)

You can download the presentation here.

Refer:Guidance Software

Encase v6 Comprehensive Internet History Search and Firefox Mork Databases

Encase version 6 now includes considerable functionality in recovering Internet History records for a number of browsers.

In a recent case using v6.12.1 I ran a search for internet history with the Comprehensive search option selected. My results included relevant hits in unallocated clusters which Encase attributed to Mozilla History/Forms. The results are recorded within the Encase Records tab and when highlighting a record some data was highlighted in the view pane which made me scratch my head - and luckily loosen some cobwebs in a long ago abandoned area of my brain. What was Encase showing me

My suspect was using Firefox version 1.8. Firefox can save (subject to user configuration) information entered into web forms and the search bar to make form filling and searching faster. This information is saved in a file known as formhistory.dat. Encase had found data within unallocated that was a fragment of a deleted formhistory.dat file. In this version of Firefox formhistory.dat contained a Mork database. Encase had highlighted in the view pane what I will loosely refer to as the address of the data that it had parsed out.

[8(^83^83)(^82^8A)]

To understand this better we need to look more closely at all the data in the database. Because the hit was in unallocated I needed to find the start of the deleted formhistory.dat file. The file signature of the file is highlighted in the screenshot below

so I scrolled up in the view pane, found this header and swept down to the footer (which is the } after the last address) and exported out the data as a file

Open the file with Notepad and find/replace all the $00 strings with an empty string. The file now looks a lot more readable

In the example we are working through the address we are interested in is

[8(^83^83)(^82^8A)]

which can be seen shown in red at the bottom of Screenshot 4 above. This address is a row within the Mork database. The row is delimited with open and close square brackets [] and is made up of a Row Object ID followed by a series of cells delimited by open and close brackets (). The cells contain a column name and a value.

The column names are defined within a dict delimited with <> shown in green at the start of Screenshot 4 above. It can be seen that two column names are relevant here name and value, given object ids of 83 and 82 respectively.

The values are defined within the next dict down. The one relevant to our address are shown in red.

[8(^83^83)(^82^8A)]

decodes to

[8(^Name^searchbar-history)(^Value^vmware fusion)]

The Name column contains the type of record - searchbar-history means what it says on the tin, other values may relate to various fields found on web page forms. The query field on the Google Firefox start page is represented by q .

Encase does not report these records particularly well. I chose to export relevant records into a spreadsheet and manually add the physical sector and sector offset of each row.

References
https://support.guidancesoftware.com/forum/showpost.php?p=115379&postcount=2
http://www.mozilla.org/mailnews/arch/mork/primer.txt
https://developer.mozilla.org/en/Mork_Structure

How To Load DD Images into EnCase TM

If you are dealing with a forensic hard drive copy that is in DD format, it is a simple but not intuitive process to load that drive image into EnCase.

Here’s how you do it.


Step 1:  From the File Menu, Select Add Raw Image

Step 2: Select the type of image you need to load.  Is this example I am going to load a Disk Image

Step 3: Right click in the Component Files area and Select New

Step 4: Browse to the folder containing the images and sort them in ascending order.

Step 5:  Select all of the parts of the DD image.

Step 6: Click OK to load the image parts into the Component Files dialog.

Step 7: Click OK again to load the parts into Encase

You should now see the drive image correctly mounted in EnCase.


Post comments, for more EnCase Stuffs........