Question 1

Compare and analyze the two centralized backup technologies NetworkAttached Storage (NAS) and Storage Area Network. Describe FIVE (5)
differences between them.

More Differences
NAS

SAN

Almost any machine that can connect to the LAN (or

is interconnected to the LAN through a WAN) can use
NFS, CIFS or HTTP protocol to connect to a NAS and
share files.

Only server class devices with SCSI Fibre

Channel can connect to the SAN. The Fibre
Channel of the SAN has a limit of around
10km at best

A NAS identifies data by file name and byte offsets,

transfers file data or file meta-data (file's owner,
permissions, creation data, etc.), and handles
security, user authentication, file locking

A SAN addresses data by disk block number

and transfers raw disk blocks.

A NAS allows greater sharing of information

especially between disparate operating systems such
as Unix and NT.

File Sharing is operating system dependent

and does not exist in many operating
systems.

File System managed by NAS head unit

File System managed by servers

Backups and mirrors (utilizing features like NetApp's

Snapshots) are done on files, not blocks, for a
savings in bandwidth and time. A Snapshot can be
tiny compared to its source volume.

Backups and mirrors require a block by block

copy, even if blocks are empty. A mirror
machine must be equal to or greater in
capacity compared to the source volume.

Question 2
Describe TEN (10) steps to prepare for a computer forensic investigation.

1. Obtain authorization to search and seize.

2. Secure the area, which may be a crime scene.
3. Document the chain of custody of every item that was seized.
4. Bag, tag, and safely transport the equipment and e-evidence.
5. Acquire the e-evidence from the equipment by using forensically sound
methods and tools to create a forensic image of the e-evidence.
Keep the original material in a safe, secured location.
6. Design your review strategy of the e-evidence, including lists of
keywords and search terms.

7. Examine and analyze forensic images of the e-evidence (never the

original!) according to your strategy.
8. Interpret and draw inferences based on facts gathered from the eevidence. Check your work.
9. Describe your analysis and findings in an easy-to-understand and
clearly written report.
10.

Give testimony under oath in a deposition or courtroom.