With the rapid development of the Internet of Things and artificial intelligence, people's dependence on data in their work and life is increasing day by day, making efficient and secure storage of data increasingly important. As an effective solution for organizing multiple disk storage, RAID (redundant array of independent disks) has been widely used in recent years and is also a data storage method that public security organs pay great attention to when extracting data during the process of handling cases. However, in the process of investigation and evidence collection, investigators often need to restore the content and structure of RAID data damaged by suspects, and correctly restructuring RAID disk arrays has become an important prerequisite and necessary link for involved website reconstruction analysis and forensics. This article shared a case of illegal transaction website reconstruction based on RAID recombination, detailed the process of RAID restructuring, explained the simulation restoration method for restoring the original server environment after successful RAID restructuring, and provided the operation process for connecting the website and database in a virtual machine environment, and hopes to provide useful reference for electronic data forensics of similar cases.