Nationwide Toll Free: (877) 787-7075

Understanding Forensic Imaging and Data Collection Cost

Forensic Data Collection of a hard drive

Forensic data collection of a hard drive using Voom’s Hard Copy 3p


Understanding Forensic Imaging and Data Collection Cost

A Surveillance Specialist Group examiner  recently had a conversation with an associate of the very prestigious global law firm Denton’s New York office.  The associate was amazed at the varied cost  ($1000-$5000) that she received when she called various vendors in the Tampa Bay area of Florida to assist with a forensic data collection project. This article explains some of the costs associated digital evidence collection as well as things you may want to ask a vendor before you hire them. Forensic Imaging Software 

  • Assuming the vendor is qualified, the first item associated with the cost of forensic imaging is the hardware and software used to collect the data. FTK, Encase, and many other companies offer their forensic imaging software at no cost.  The forensic imaging software has to be used with a computer and a write blocker (which protect the source media from contamination). This method of collection is often slower than using a stand-alone forensic imaging hardware.  This slower method of data collection is often used because the vendor doesn’t do enough data collection to warrant the cost of a standalone device; they are new to the field; or they simply want to generate billable hours.  Your first question should be, what type of hardware will you use to collect the data?
Forensic Data Collection of a hard drive using write blocker

Forensic Data Collection of a hard drive using write blocker

Forensic Imaging Hardware

  • Standalone forensic imaging devices such as Voom’s Hard Copy 3p  offer the forensic expert the ability to quickly create multiple verified images of a single source drive at the same time (one copy for the examination and a second copy for a backup, the client, or to keep in evidence). I will list all of the reasons you will want a second copy in a different article.  The 1# reason is that you only get one chance on a subpoena. On average a vendor who utilizes such devices will save the client two (2) to eight (8) billable hours per image.   Question number two should be, how many images will you create per source media?

Copies Per Forensic Imagine

  • Storage media is the next expense associated with the forensic imaging process.  Some vendors will create one forensic image to a single hard drive and bill the client a marked up cost for each drive.  A less expensive approach would be to have multiple images on a multiple hard drives. For example you have three 256-gigabyte (GB) hard drives and you need two copies of each at $100 per drive ($600) for vendor “A”. Vendor “B” uses two 2 terabyte (TB) to store three images per drive at $175 per drive ($350).  So question number three should be, do you  use a single hard drive per image or multiple images on a single hard drive?

Hard Drive Speed

  • The data transfer or write speed of the target hard drive also relates to cost and billable hours. A 7200rpm hard drive is more expensive than a 5200 rpm hard drive simply because they transfer data faster.  Forensic imaging is only as fast as the slowest component in the process.  Vendor “A” may charges less per hour, but making up the difference by extending the time it takes to do the job. Vendor “B” may charge more per hour and for the hard drives simply because he’s using better more expensive hardware throughout the process.  This isn’t a deal breaker but you should inquire about the drive speed so that you better understand your vendor.

Sanitizing and Wiping Client Data

  • In some cases the vendor is asked to make multiple forensic copies. One to be shipped to the client and the second to be held onto until the first copy reaches the client and is re-verified. Hard Drives that are recycled by the vendor must be sanitized before they can be used for the next client.  This process can take up to 4 hours for a 268GB hard drive. Not only does this make the drive unavailable for use, its behind the scene labor cost associated with the process.

Forensic Imaging and Data Collection Cost Outsourcing

  • It’s been my experience that when a client receives an outrageous quote for forensic data collection, the excessive estimate is usually the result of the work being out sourced to a third party.  A national brand is usually a fancy way of not saying, the work will be performed by a local subcontractor. The cost is marked-up from there. So the next question here is, will an employee of the actual company be doing the forensic imaging or will it be outsourced to a third party?

A less experienced vendor making a single forensic image one at a time from their laptop and using slow hard drives can cost you lots of money in the end.  They may quote one price and bill you a much higher price once they perform the work.  Most experienced vendors can estimate your cost and won’t go over unless there is some variable that was beyond the proposed scope of work. Other cost are based on demographics, more competitive markets have companies that offer reduce prices.  And there you have it, forensic data collection cost explained.  Surveillance Specialist of Tampa, FL offers discounted rates on matters wherein we provide the analysis as well. Contact us today for a free consultation.