Digital forensic investigation methodology for Storage Space: Based on the NIST digital forensic process
- Authors
- Kim, Junho; Lee, Sangjin; Jeong, Doowon
- Issue Date
- 5월-2022
- Publisher
- WILEY
- Keywords
- digital forensics; RAID forensics; RAID reconstruction; software-based RAID; Storage Space; windows forensics
- Citation
- JOURNAL OF FORENSIC SCIENCES, v.67, no.3, pp.989 - 1001
- Indexed
- SCIE
SCOPUS
- Journal Title
- JOURNAL OF FORENSIC SCIENCES
- Volume
- 67
- Number
- 3
- Start Page
- 989
- End Page
- 1001
- URI
- https://scholar.korea.ac.kr/handle/2021.sw.korea/142322
- DOI
- 10.1111/1556-4029.14992
- ISSN
- 0022-1198
- Abstract
- For forensic examiners, investigating the RAID systems of servers has been challenging, as the examiners must reconstruct multiple high-capacity disks to identify digital evidence. Software-based RAID systems' use has been released for personal use, so examiners should consider RAID systems even when they investigate personal computers. Although there is a high probability that the software-based RAID will become a target of crime, there has been little research into digital forensic methodology for software-based RAID, as exemplified by Storage Space. In this paper, we introduce details about the structure of Storage Space found through reverse engineering. Storage Space was analyzed by applying the digital forensic process of NIST. We explain how to reconstruct a virtual disk configured using Storage Space and develop an automated tool to do so. To evaluate our study and the tool developed, we created an experimental scenario and describe in detail the forensic procedure and technical methods for the analysis of Storage Space. Our research can be used as the basis of forensic investigations for Storage Space.
- Files in This Item
- There are no files associated with this item.
- Appears in
Collections - School of Cyber Security > Department of Information Security > 1. Journal Articles
Items in ScholarWorks are protected by copyright, with all rights reserved, unless otherwise indicated.