As someone who has been a database server admin, it really bothers me that they were given access to something they did not understand. That's not how audits work.
But worse, it would appear CyberNinjaDudes didn't understand how to make or use so-called "forensic clones" any more than they understood SQL Server. A forensic clone of a drive is typically an bit-for-bit image of a drive. It gets complicated for RAID arrays because the new images have to be reconfigured back into a functioning volume or volumes (think: drive letters like "D: drive"
. That they would move forward with their analysis before verifying and ensuring that they had functional volumes simply makes no sense.
It's almost like they were hired to make a certain finding and did so with only the flimsiest of made up data to back it.
Edit history
= new reply since forum marked as read
