Couple of questions here-
How long do people have to archive cases for and under what legislation?
What archiving techniques are used?
And most curiously, has anyone considered the issue of archiving something for a long period of time and then no longer having the ability to access it again? maybe the software package is now obsolete etc?
……DO we give archiving enough thought? or am I being dramatic here and we really dont have any issues?
….Should we be archiving old kit to access material? Like a museum of test devices just in case we need them later?
In the criminal field and the civil field, we would hold cases until the prosecutor/client's attorneys said we could delete them. This would include the images and any work product. Work product did include the files generated by forensic programs. We stored them on a server. In the criminal field, our reports were saved to a disk and kept separately in the Evidence Unit.
About every 3 to 4 years, we would contact the attorney/prosecutor, and see if we still needed to keep the images/work product. If they did not, we would delete them.
I would recommend keeping copies of the forensic programs you use and their various installation files. For example, I would keep the installation files for your-favorite-software-v1, your-favorite-software-v2, and so on. Most companies can give you archived copies of their older editions, but if they go out of business then you're screwed. That way if you have to reproduce the results you had, you can do it with the same version of the software you were using at the time.
Keeping older devices and hardware that can support them is highly recommended. You never know what type of device is going to come through the door. You might think you do not need that IDE writeblocker anymore, but you would be surprised.
