In a RAID 1 setup, a company ' s critical database is stored across two...

According to the CHFI v11 objectives under Digital Evidence and Operating System Forensics , understanding RAID configurations is essential for both evidence acquisition and incident analysis. RAID 1 , also known as disk mirroring , ensures data integrity and availability by duplicating identical data across two or more physical drives . Every write operation is simultaneously written to both drives, creating an exact replica of the data at all times.

In the event of a single hard drive failure, RAID 1 allows the system to continue operating seamlessly using the remaining drive , with no interruption to data access and no data loss. This immediate failover capability is what ensures high availability and strong data integrity, making RAID 1 especially suitable for mission-critical systems such as databases and forensic evidence repositories. From a forensic perspective, investigators can still access complete and consistent data even after a hardware failure.

Option A is incorrect because a rebuild is only required after replacing the failed drive , not to maintain immediate availability. Option C is incorrect because RAID 1 does not prioritize a single drive; reads may even be faster due to parallel access. Option D describes parity-based RAID levels such as RAID 5 or RAID 6, not RAID 1.

The CHFI Exam Blueprint v4 explicitly includes RAID storage systems and forensic considerations , emphasizing RAID 1’s role in redundancy and fault tolerance. Therefore, duplicating data to ensure immediate access and protection is the correct and exam-aligned explanation