±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 2 Overall: 36212
New Yesterday: 4 Visitors: 221

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

Case File Sizes

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Page 1, 2  Next 

What is your average case file size?

11
52%

6
28%

4
19%

 
Total Votes: 21

  

nickfx
Senior Member
 

Case File Sizes

Post Posted: Apr 23, 13 21:51

Having just finished a case of over 5 TB and started on the next one which is an 8Gig USB key (ridiculous to the sublime!), it got me thinking, what would you say is your average case size now?

I looked back to cases in 2005 and I was often seeing 40 to 80 gig drives so a case with a few machines might be a max of 100gig tops. Not unusual now to break the 1 TB+ barrier from a single source.

What about you?

Nick  
 
  

LukeLuke
Member
 

Re: Case File Sizes

Post Posted: Apr 24, 13 17:55

Case size you mean the overall size of all the drives imaged?  
 
  

mitch
Senior Member
 

Re: Case File Sizes

Post Posted: Apr 24, 13 18:06

Very interesting subject.

Im working on a case now that is 17TB fully imaged, imported all exhibit(s) into Encase 6.19.7. Thankfully running smoothly, all now is to locate certain files and focus on them. so will reduce dramatically in size.

Mitch  
 
  

nickfx
Senior Member
 

Re: Case File Sizes

Post Posted: Apr 24, 13 18:29

- LukeLuke
Case size you mean the overall size of all the drives imaged?


Yes bud  
 
  

flamerescue150
Member
 

Re: Case File Sizes

Post Posted: Apr 24, 13 18:53

I'm seeing an average of 2 - 3 TB of images per case with extremes of 25TB. In my opinion the actual processing of this much data isn't the largest hurdle, but rather the retention and backing up of case data after the case is finished. Depending on the client request, we have retention periods of ALL case data and results that can last over 2 years. It becomes an interesting dilemma to figure out where to store all of this data. And once you have it all stored somewhere.... try to back it up in the event of a disaster.  
 
  

sward6
Member
 

Re: Case File Sizes

Post Posted: Apr 25, 13 07:45

Most of all my my CP cases I have worked, I have been getting 6-10 HDs (200GB-1TB) to examine. My department is running out of storage space.  
 
  

jhup
Senior Member
 

Re: Case File Sizes

Post Posted: Apr 25, 13 18:07

I think the question could use some refinement.

For example, the mentioned CP case may involve 1 to 5 individuals and their desktops, laptops, USB flash drives, CDs, DVDs, etc.

A corporate IP case may involve 100 to thousands, with each machine, network drives, SANs, full Exchange clusters, cloud nodes, etc.

You Keep Using That Word, I Do Not Think It Means What You Think It Means
 
 

Page 1 of 2
Page 1, 2  Next