±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 36115
New Yesterday: 0 Visitors: 123

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

Digital Archiving

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
 
  

tootypeg
Senior Member
 

Digital Archiving

Post Posted: Mar 27, 19 21:32

Couple of questions here:-

How long do people have to archive cases for and under what legislation?

What archiving techniques are used?

And most curiously, has anyone considered the issue of archiving something for a long period of time and then no longer having the ability to access it again? maybe the software package is now obsolete etc?

......DO we give archiving enough thought? or am I being dramatic here and we really dont have any issues?

....Should we be archiving old kit to access material? Like a museum of test devices just in case we need them later?  
 
  

kastajamah
Senior Member
 

Re: Digital Archiving

Post Posted: Mar 27, 19 22:02

In the criminal field and the civil field, we would hold cases until the prosecutor/client's attorneys said we could delete them. This would include the images and any work product. Work product did include the files generated by forensic programs. We stored them on a server. In the criminal field, our reports were saved to a disk and kept separately in the Evidence Unit.

About every 3 to 4 years, we would contact the attorney/prosecutor, and see if we still needed to keep the images/work product. If they did not, we would delete them.

I would recommend keeping copies of the forensic programs you use and their various installation files. For example, I would keep the installation files for your-favorite-software-v1, your-favorite-software-v2, and so on. Most companies can give you archived copies of their older editions, but if they go out of business then you're screwed. That way if you have to reproduce the results you had, you can do it with the same version of the software you were using at the time.

Keeping older devices and hardware that can support them is highly recommended. You never know what type of device is going to come through the door. You might think you do not need that IDE writeblocker anymore, but you would be surprised.  
 

Page 1 of 1