Discs and drives just keep getting bigger and cheaper. You can now get a 64gb card for your phone or camera for less than $30. Pop quiz: if you do a physical acquisition of a 64gb drive / card, how much storage will you need for the resulting file? Bonus question, how will you share / distribute the results?
Next question, how long will it take to acquire that file? If you're moving 64gb through a diagnostic port, it'll take days. If you're moving that much data through USB 1, it might take a day. Most devices haven't moved beyond USB 1 speeds. Thus, you'll need to account for the fact that your acquisition device will be tied up for a while. It might be time to budget for a second, or a third capture tool.
What about billing? Do you bill for machine time? Is it billed separate from technician time? If your machine is working on a single acquisition for 2 days, it can't work on anything else. Do your billing policies reflect this reality?
Finally, many agencies have written policies / procedures that call for storage / distribution on WORM discs. Great. What are you going to do with that 64gb .bin file?
If you haven't updated your SOPs and billing policies to account for the increases in media size, it's time.
No comments:
Post a Comment