No announcement yet.

OSForensics - Examine Synology NAS

  • Filter
  • Time
  • Show
Clear All
new posts

  • OSForensics - Examine Synology NAS

    If have some questions about a Synology NAS and hope to find some answers here.

    I got a Synology NAS from a client a few days ago and my job will be to analyze if there were data deleted on it and when they have been deleted. It is a RAID1 Storage with two harddisks inside. I made an Image of both disks with the FTK-Imager ( .e01) but as far as i know Synology uses Hybrid RAID and BTRFS filesystem.

    Will i be able to get those needed Information with OSForensics ?
    Is it possible to rebuild the RAID1 with the images in OSForensics ?

    And my last question, how about a Discord-Channel ? Are there any plans for opening a own Discord-Channel from OSForensics ?

    Any help would be welcome.....Thank you..

  • #2
    We have never done any testing with a Synology NAS.

    RAID 1 is mirroring. So is there any point in "rebuilding" it? The drives should be identical.

    Synology Hybrid RAID (SHR) looks to be a term Synology's marketing team created and isn't any industry standard as far as I can see. It seems to have the most impact when there are more than 2 drives and the drives are all different sizes. So maybe it can be ignored here.

    At the moment the supported file systems in OSF are,
    • NTFS (Windows)
    • FAT16 / FAT32 / exFAT (DOS/Windows)
    • Ext2 / Ext3 / Ext4 (Linux/Android)
    • HFS+ / HFSX (Mac/iPhone/iPad)
    • APFS (Mac/iPhone/iPad)

    BTRFS is on our to do list as there is talk of one day this becoming the default Linux file system (it is EXT4 for the moment).

    E01 isn't a great option for performance. The ZLIB compression algorithm limits the speed to 100MB/sec for everything.

    Not sure how active a Discord channel would be. Having lots of different social media channels tends to spread all the information around making it hard to find.