Disk arrays are impossible to correctly image as you are unable to get correct drive geometry.

Question

Options

• ATrue
• BFalse

• A
  25% (6)
• B
  75% (18)

Explanation

B (False) is correct because disk arrays - whether RAID, JBOD, or other configurations - can be accurately imaged using forensic tools that handle drive geometry correctly. Modern imaging software (e.g., FTK Imager, dd, Guymager) can image individual physical drives within an array or the logical volume presented by the array controller, capturing accurate sector-by-sector copies regardless of geometry.

Why A (True) is wrong: Drive geometry (cylinders, heads, sectors) is either reported correctly by the drive firmware or can be determined through the imaging tool itself. The complexity of RAID geometry doesn't make imaging impossible - it may require additional steps (like reassembling a RAID set in software), but it is absolutely achievable with proper forensic methodology.

Memory tip: Think of "array = arrangement." A disk array is just an arrangement of drives - forensic tools can still image each physical drive individually, and RAID reconstruction tools can then re-assemble the logical volume. If you remember that "impossible" is almost never correct in forensic statements about established tools, you'll avoid overstatements like option A.

No community discussion yet for this question.