Clear all

Case File Sizes  

Active Member

Having just finished a case of over 5 TB and started on the next one which is an 8Gig USB key (ridiculous to the sublime!), it got me thinking, what would you say is your average case size now?

I looked back to cases in 2005 and I was often seeing 40 to 80 gig drives so a case with a few machines might be a max of 100gig tops. Not unusual now to break the 1 TB+ barrier from a single source.

What about you?


Posted : 23/04/2013 10:51 pm
Junior Member

Case size you mean the overall size of all the drives imaged?

Posted : 24/04/2013 6:55 pm
Active Member

Very interesting subject.

Im working on a case now that is 17TB fully imaged, imported all exhibit(s) into Encase 6.19.7. Thankfully running smoothly, all now is to locate certain files and focus on them. so will reduce dramatically in size.


Posted : 24/04/2013 7:06 pm
Active Member

Case size you mean the overall size of all the drives imaged?

Yes bud

Posted : 24/04/2013 7:29 pm
New Member

I'm seeing an average of 2 - 3 TB of images per case with extremes of 25TB. In my opinion the actual processing of this much data isn't the largest hurdle, but rather the retention and backing up of case data after the case is finished. Depending on the client request, we have retention periods of ALL case data and results that can last over 2 years. It becomes an interesting dilemma to figure out where to store all of this data. And once you have it all stored somewhere…. try to back it up in the event of a disaster.

Posted : 24/04/2013 7:53 pm
New Member

Most of all my my CP cases I have worked, I have been getting 6-10 HDs (200GB-1TB) to examine. My department is running out of storage space.

Posted : 25/04/2013 8:45 am
Community Legend

I think the question could use some refinement.

For example, the mentioned CP case may involve 1 to 5 individuals and their desktops, laptops, USB flash drives, CDs, DVDs, etc.

A corporate IP case may involve 100 to thousands, with each machine, network drives, SANs, full Exchange clusters, cloud nodes, etc.

You Keep Using That Word, I Do Not Think It Means What You Think It Means

Posted : 25/04/2013 7:07 pm
New Member

Most cases we see are 500GB and up per drive, and with pock HDDs being 50 for 500GB we have been finding more and more external storage. I just built a storage server using 36 3TB drives in a raid 6 configuration to archive cases, and it will fill up soon. Luckily the controller card can handle up to 255 drives so I can expand it using 48 drive expansion units.

Posted : 03/05/2013 12:38 am