OSForensics - Examine Synology NAS

[Cherubino]

If have some questions about a Synology NAS and hope to find some answers here.

I got a Synology NAS from a client a few days ago and my job will be to analyze if there were data deleted on it and when they have been deleted. It is a RAID1 Storage with two harddisks inside. I made an Image of both disks with the FTK-Imager ( .e01) but as far as i know Synology uses Hybrid RAID and BTRFS filesystem.

Will i be able to get those needed Information with OSForensics ?
Is it possible to rebuild the RAID1 with the images in OSForensics ?

And my last question, how about a Discord-Channel ? Are there any plans for opening a own Discord-Channel from OSForensics ?

Any help would be welcome.....Thank you..

[David (PassMark)]

We have never done any testing with a Synology NAS.

RAID 1 is mirroring. So is there any point in "rebuilding" it? The drives should be identical.

Synology Hybrid RAID (SHR) looks to be a term Synology's marketing team created and isn't any industry standard as far as I can see. It seems to have the most impact when there are more than 2 drives and the drives are all different sizes. So maybe it can be ignored here.

At the moment the supported file systems in OSF are,

• NTFS (Windows)
• FAT16 / FAT32 / exFAT (DOS/Windows)
• Ext2 / Ext3 / Ext4 (Linux/Android)
• HFS+ / HFSX (Mac/iPhone/iPad)
• APFS (Mac/iPhone/iPad)

BTRFS is on our to do list as there is talk of one day this becoming the default Linux file system (it is EXT4 for the moment).

E01 isn't a great option for performance. The ZLIB compression algorithm limits the speed to 100MB/sec for everything.

Not sure how active a Discord channel would be. Having lots of different social media channels tends to spread all the information around making it hard to find.