This issue has been brought up before, but time to modernize it and MD5 it (a substitute for rehash good or bad computer humor??)
I've been talking with a respected member of the forums in PM's and am curious what your thoughts and rates are.
What do you charge for having a hard drive to either index in say FTK or look for something in Encase. This is AFTER initial processing of the case. You posted here in the services section and someone in Balkavile, KD imaged the drive for you and sent you the images, there is nothing you can do about receiving the image like this, nor for our purposes are you concerned about that. As far as you know, you received grade A images.
So give out two prices here (in case your prices for the situation differ)
1. You have a computer running where you aren't doing any exam on it, it's just using up one of your dongles (which you have other work you could be doing if that dongle was freed up)
2. You have a computer where you are asked to index additional items not pre processed (i.e. maybe @, http, .cn .org, etc.) and it also requires a station and a dongle.
Both are running unmanned, however the second situation you would have to at least input search terms and select the type of searching needed. Also, you have other work which needs to be done but you are limited on dongles. To take other issues out of the equation you aren't going to make enough from the case to buy another dongle, nor does the client care to shell that out.
This will also probably be a topic on the new podcast so throw out what you do and your opinions on what others you have gone up against or other people you know do.
If you read this, please take time to post some kind of an answer, even if 100 people read it and have relatively the same answer, it's nice to see people take time to respond.
If you read this, please take time to post some kind of an answer …
In general, the cost of the analysts time, rounded up to the nearest billable unit – say, half hour. Doing a search as part of the general case work is usually nothing extra, unless it happens to cross the half-hour line. But then any work would do the same. An extra search, done late in the case, when the customer is pondering the preliminary report, usually starts a new half-hour.
If you read this, please take time to post some kind of an answer, even if 100 people read it and have relatively the same answer, it's nice to see people take time to respond.
Work for LE, not really applicable.
Thank you for replying, I appreciate it.
If you worked for yourself, what do you think you would do as far as fees go. You have a very interesting perspective being in the UK and also being LE so you know what volume of business you might get, what other examiners might charge, etc.
If you read this, please take time to post some kind of an answer, even if 100 people read it and have relatively the same answer, it's nice to see people take time to respond.
Work for LE, not really applicable.
Thanks for your reply.
Ok, so say your index run will take 3 days per hard drive and you have several drives. What are you charging for that?
If you read this, please take time to post some kind of an answer …
In general, the cost of the analysts time, rounded up to the nearest billable unit – say, half hour. Doing a search as part of the general case work is usually nothing extra, unless it happens to cross the half-hour line. But then any work would do the same. An extra search, done late in the case, when the customer is pondering the preliminary report, usually starts a new half-hour.
I charge for my time only as I'm the one with the experience and knowledge, not the computers.
I know some people charge for processing time, but I find it difficult to justify. You can run multiple instances of X-Ways, EnCase, etc. on multiple cores with dozens of GB of RAM. I don't see why the client should be charged just because you don't have enough processing power/computers/dongles.
Would be keen to hear from those who charge for processing time and why.
Thank you for replying, I appreciate it.
If you worked for yourself, what do you think you would do as far as fees go. You have a very interesting perspective being in the UK and also being LE so you know what volume of business you might get, what other examiners might charge, etc.
If you read this, please take time to post some kind of an answer, even if 100 people read it and have relatively the same answer, it's nice to see people take time to respond.
Work for LE, not really applicable.
From what I can tell of UK private companies that we have sent work to, we usually pay a (very large)fixed fee and this is based on the number of hours they work on the job. I don't think they charge for processing time, especially as they could run processes over night.
I realize your situation is slightly different as you cant really work on other cases while this is running.
Hope this helps
I know some people charge for processing time, but I find it difficult to justify.
Agreed.
I think charging a nominal fee for the machine time is reasonable. After all, there is machine depreciation, software depreciation, opportunity cost, etc.
Charging real, man-hour rates for machine hours is unethical, but that is just me.
We usually charge for "machine time" which is billed as half the time of our forensic rate. We charge "machine time" for tasks such as recovering folders, parsing emails/internet history, etc.