According to the CHFI v11 Digital Evidence and Storage Fundamentals , RAID (Redundant Array of Independent Disks) configurations are critical for investigators to understand because they directly impact data availability, fault tolerance, and evidence reconstruction during forensic analysis. RAID 5 is one of the most commonly deployed RAID levels in enterprise environments due to its balance between performance, storage efficiency, and redundancy.

In a RAID 5 configuration , data and parity information are striped across all disks in the array . This means that parity blocks are not stored on a single dedicated drive; instead, parity is rotated among all participating drives . This design eliminates the bottleneck associated with a single parity disk and improves read performance while still providing fault tolerance.

If one drive fails, RAID 5 uses the distributed parity information along with the remaining data blocks to reconstruct the missing data on-the-fly , ensuring continued access to information. From a forensic perspective, this distributed parity mechanism is significant because investigators must correctly identify the RAID structure to rebuild the array and recover digital evidence accurately.

CHFI v11 explicitly differentiates RAID 5 from RAID 3 and RAID 4, which use dedicated parity disks , and from RAID 1, which relies on mirroring. Therefore, the correct and CHFI-aligned answer is Parity data is distributed across all drives in the array , making Option B correct.