While data collection may seem like a straightforward process, it rarely is.  There are an innumerable amount of unforeseeable circumstances, computer technologies, and people that can cause problems during an on-site collection.  In this multi-entry blog series, we'll be discussing the most common items and the people that can make data collection more difficult for you so that you can make more informed decisions during your collections and collection prep.

RAIDs

If the computer contains a RAID (Redundant Array of Inexpensive Disks), it is often necessary to run the collection through the computer without removing the hard drives.  Many servers store data using a RAID.  A RAID consists of several hard drives that are grouped together and (depending on the type of RAID) has saved data spread across all the drives.  A RAID may be used for a number of reasons, but they are most commonly used as a way to create extra copies of data in case of a single hard drive failure; if one of the hard drives fails, the data that it contains can be recovered because it was replicated (using an algorithm) onto the other hard drives that were in that RAID.

If the hard drives are removed from the computer containing the RAID, they do not maintain the structure of how the data is stored and are therefore unusable.  To help illustrate this, imagine that you cut out the words in a paper document and put them in a number of different boxes in a pattern that only you knew.  If someone mixed up all of the boxes, you would never again be able to read the document unless the boxes were put back in the exact order that you had them.  If the RAID hard drives are removed from the computer, they must be put back into the same RAID computer (which knows the pattern) using the exact hardware location that they were removed from.  Mixing up a single cable will make the data unrecognizable.  Inexperienced vendors sometimes pull these hard drives out of the system and don't keep track of how they were organized, and the data becomes unusable. 

Exotic and Legacy Computers

It doesn't take long for technology to become outdated in today's world.  It is difficult for all companies to keep all of their computers current, especially if the computers are still working and there is no reason to upgrade.  While this may work well for the company, it can cause your EDD vendor serious problems.  Older computers can cause problems for any of the following reasons:

• Computers might not have the proper connections to allow for the duplication of data.
• Older connections may only allow for very slow data transfers.
• Computers that have been running fine for fifteen years may inexplicably not turn back on after they've been shut down.
• Current forensic software may not read and process the data on the older computers, which would mean more hands-on (and more expensive) collection and processing work.

Despite the problems with exotic and legacy computers, there are sometimes work-arounds to get the necessary data, such as duplicating from back-up media such as tapes or other external media.  This is useful when examiners are concerned about harming the target computer.  Be sure to keep your vendor informed if your client has any exotic or legacy systems (and if backups of these systems exist) so that they can prepare as best they can.

An EDD firm that is informed of what a collection will entail (especially when dealing with the difficult items we've discussed here) will make for a much more successful and inexpensive collection.