According to theCHFI v11 Digital Evidence and Storage Fundamentals, RAID (Redundant Array of Independent Disks) configurations are critical for investigators to understand because they directly impactdata availability, fault tolerance, and evidence reconstructionduring forensic analysis. RAID 5 is one of the most commonly deployed RAID levels in enterprise environments due to its balance between performance, storage efficiency, and redundancy.
In aRAID 5 configuration, data and parity information arestriped across all disks in the array. This means that parity blocks are not stored on a single dedicated drive; instead, parity isrotated among all participating drives. This design eliminates the bottleneck associated with a single parity disk and improves read performance while still providing fault tolerance.
If one drive fails, RAID 5 uses the distributed parity information along with the remaining data blocks toreconstruct the missing data on-the-fly, ensuring continued access to information. From a forensic perspective, this distributed parity mechanism is significant because investigators must correctly identify the RAID structure to rebuild the array and recover digital evidence accurately.
CHFI v11 explicitly differentiates RAID 5 from RAID 3 and RAID 4, which usededicated parity disks, and from RAID 1, which relies on mirroring. Therefore, the correct and CHFI-aligned answer isParity data is distributed across all drives in the array, makingOption Bcorrect.
