We recently started trying an external Rev Drive (by Iomega) with 120GB tapes. Don't really know about long term reliability yet, though.
Dave.
There has been some research done in Antwerp Belgium by mr Filip Boudrez
from the Expertisecentrum DAVID in 2009. He wrote down his findings in a document (unfortunately in Dutch). But if you want answers I think you can mail him and perhaps he can give some sound advice. I believe that the archiving of our data is a very big problem. And with the coming of the 2 and 3 TB disks the problem will even get bigger. We now have a datastorage capabillity of 70 TB thats constantly running over. At the moment I'm dealing with a 1 child porn case that produces 65 TB data. So you tell me where I can go with that. I recognise your question as a valid and troubeling problem for us as digital investigators. I wonder how e.g. filmstudios archive their data. That also must be huge. Even more than we do. Did you get information there. Or perhaps museums with large amounts of documents. But to answer your question, we archive also on HDD at this moment. We also used DVD and tapes. But HDD was the best option.
Long term storage is not as easy as it seems. Every single day, huge capacity hard drives come out and one case could include up to 10-20 computers each with 1 TB hard drive. So, even if you have hundreds of TBs of storage area, it will be filled up in a short time. Unless you add new disks into your storage, you will fail to keep enough free space for new acquisitions.
On the other hand, the fact that you have kept images does not mean they will still work in 7-8 years time. The files on hard drives after 7-8 years will somehow produce errors such long period of storage. It seems best to set a limit for maximum length of time during which the images would be stored.
This is the link for an interesting piece on long term storage.
http//
As for the term to keep the stored files. This shoukl be left to a judge who can determine that de stored data on a particular case can be deleted.
Thanks for the link.
I think this is an issue in general for large corporation who want to take a proactive step and preserve ESI in case of potential litigation, not just actual court cases.
I know of one large firm where they have over 20K employees. With turn over rate of 10% per annum of which 5 to 10% threatens with litigation, they image 100 to 200 drives and other data storages, ranging form 80GB to 120GB. That is still only 8 to 12TB storage per year.
Of course, the issue of maintenance and historical document format (as the referenced article points out) becomes a headache, if not a full blown migraine.
I did do a quick search online for the article at the time I wrote the post, but to no immediate luck. I do have it hard copy and it was in an issue earlier this year. I will endeavour to find it.
The more weeks that pass, the harder it is to find…
J.
I have dug out the New Scientist print article and from that have found the article online, albeit a different title (link below).
Simonite, T. Le Page, S.
Now We Know It
New Scientist 2010, Vol 205 (No 2745) pg 36-39
http//
Estimated longevity (years)
Analogue Tape 20
Digital Tape 13
Audio CD, DVD Movie 26
CD-R (cyanine and azo dyes) 8
CD-RW, DVD RW, DVD+RW 8
CD-R (phthalocyanine dye, silver metal layer) 26
CD-R (phthalocyanine dye, gold metal layer) 100
DVD-R, DVD+R 26
Flash 10
No estimate on HDD's… "the jury is still out"
Actual longevity will vary greatly depending on condition when received and further ongoing storage/use conditions.
J.
I think 26 years is sufficient in longevity as I would think in about 10 years obsolescence kicks in, but not in capacity.
On the other hand, Blu-ray Disc at 25GB starts to be reasonable. Moving to double layer with the top storage at 100GB, now that would be nice.
Also worth noting is that multi layer Blu-ray discs are also in development, boasting capacities of 400-500gb, longevity (unknown).
Write once Flash memory… different longevity (unknown).
Currently DVD-R/DVD+R seems a good 3rd backup option at 26 years.
Returning to the original question of archiving cases, ideally, current best practice
1. image onto a HDD, verify,
2. backup the image onto another HDD, verify,
3. split the image into segments to copy onto CD/DVD's, verifying each.
J.
My boss decided we would save evidence for seven years so I put everything in a fire resistant security locker. We store original hard drives and I use large hard drives to archive the cases since they are cheaper than tape now. My problem is not the evidence or the data but backing up my cases from FTK. The guys at the helpdesk told me to use the archive command instead of backup and my problem now is restoring said archives which doesn't seem to work very well.