Evidence Transfer Time Calculator
Compare shipping evidence over the network against physical courier, including protocol efficiency and hash re-verification.
About Evidence Transfer Time Calculator
A nominal gigabit link rarely delivers a gigabit: TCP windowing over a long fat pipe, encryption and other traffic typically leave 50–70% usable. Both routes end with the same obligation — re-hash on arrival and compare against the acquisition digest — so verification is added to each. The break-even volume is simply how much data the link could have moved during the courier's elapsed time. A courier is embarrassingly fast for large volumes, and 'never underestimate the bandwidth of a van full of disks' is still the right answer above a few terabytes on a shared WAN link.
Formulas
Evidence Transfer Time
networkTime = size × 8 ÷ (bandwidth × usableShare × (1 − encryptionOverhead)); courierTime = preparation + doorToDoor. Both then pay size ÷ hashRate to re-verify on arrival.
- usableShare
- Fraction of nominal bandwidth TCP actually achieves
- encryptionOverhead
- Cost of in-transit encryption
- doorToDoor
- Collection to delivery time for the courier
Break-even volume
breakEvenVolume = effectiveTransferRate × courierElapsedTime — above this volume the courier wins.
- effectiveTransferRate
- GB per hour actually achieved on the link
- courierElapsedTime
- Total courier time including packaging
Worked example
With the default values below, Evidence Transfer Time Calculator returns Recommended Method of Network transfer — it lands sooner and keeps custody digital. Change any input above and every figure here is recalculated in your browser.
Inputs used
- Evidence to moveaccepts 1–1,000,000 GB
- 2,000 GB
- Link bandwidth availableaccepts 1–400,000 Mbps
- 1,000 Mbps
- Usable share of the linkaccepts 5–100 %
- 65 %
- Encryption overheadaccepts 0–50 %
- 6 %
- Re-verification hash rateaccepts 0.05–10 GB/s
- 1.2 GB/s
- Courier door-to-door timeaccepts 1–720 hours
- 18 hours
- Preparation and packaging timeaccepts 0–72 hours
- 2 hours
Results
- Recommended Method
- Network transfer — it lands sooner and keeps custody digital
- Network Transfer Time
- 7.45 hours
- Effective Throughput
- 611 Mbps
- Re-verification Time
- 0.46 hours
- Network — End to End
- 8.41 hours
- Courier — End to End
- 20.46 hours
- Break-Even Volume
- 5,236 GB
Step by step
- 1Values used
- 2Evidence Transfer Time
- 3Break-even volume
- 4Recommended Method= Network transfer — it lands sooner and keeps custody digital
- 5Network Transfer Time= 7.45 hours
- 6Effective Throughput= 611 Mbps
- 7Re-verification Time= 0.46 hours
- 8Network — End to End= 8.41 hours
- 9Courier — End to End= 20.46 hours
Assumptions and limits
- The result is derived only from the 7 inputs listed above. Anything not among them is not part of the calculation.
- In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
- Figures are rounded for display to 2 decimal places, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.
How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.
Frequently Asked Questions
How is Evidence Transfer Time calculated?
networkTime = size × 8 ÷ (bandwidth × usableShare × (1 − encryptionOverhead)); courierTime = preparation + doorToDoor. Both then pay size ÷ hashRate to re-verify on arrival. A nominal gigabit link rarely delivers a gigabit: TCP windowing over a long fat pipe, encryption and other traffic typically leave 50–70% usable. Both routes end with the same obligation — re-hash on arrival and compare against the acquisition digest — so verification is added to each. The break-even volume is simply how much data the link could have moved during the courier's elapsed time.
Why does Evidence Transfer Time matter?
A courier is embarrassingly fast for large volumes, and 'never underestimate the bandwidth of a van full of disks' is still the right answer above a few terabytes on a shared WAN link.
What values do I need to enter?
This calculator takes 7 inputs: Evidence to move, Link bandwidth available, Usable share of the link, Encryption overhead, Re-verification hash rate, Courier door-to-door time, Preparation and packaging time. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Does the courier route need extra controls?
Yes. Physical transfer needs tamper-evident packaging, encryption at rest on the shipped media, a signed custody form at each handover, and a hash comparison on arrival. The transfer time is the easy part; the custody paperwork is what gets challenged.
Why is preparation weighted differently for each route?
Network transfer needs staging and an upload script, which is a fraction of the effort of imaging to shippable media, packaging it, and completing custody documentation — so the model charges the network route a quarter of the preparation time.
Related Calculators
- Disk Imaging Time Calculator
- Hash Verification Calculator
- Forensic Evidence Storage Calculator
- Enterprise Cybersecurity Health Score Calculator
- Kill Chain Coverage Calculator
- LLM Prompt Injection Risk Calculator
- Quantum Threat Readiness Calculator
- Ransomware Impact Calculator
- Recovery Time Calculator
- AI Model Security Risk Calculator
You might also need
- Hash Verification CalculatorCommonly used together
- Forensic Evidence Storage CalculatorCommonly used together
- Disk Imaging Time CalculatorCommonly used together
- Enterprise Cybersecurity Health Score CalculatorAlso in Forensics & Emerging Threats
- Kill Chain Coverage CalculatorAlso in Forensics & Emerging Threats
- LLM Prompt Injection Risk CalculatorAlso in Forensics & Emerging Threats
