Evidence Transfer Time Calculator

networkTime = size × 8 ÷ (bandwidth × usableShare × (1 − encryptionOverhead)); courierTime = preparation + doorToDoor. Both then pay size ÷ hashRate to re-verify on arrival. A nominal gigabit link rarely delivers a gigabit: TCP windowing over a long fat pipe, encryption and other traffic typically leave 50–70% usable. Both routes end with the same obligation — re-hash on arrival and compare against the acquisition digest — so verification is added to each. The break-even volume is simply how much data the link could have moved during the courier's elapsed time.

A courier is embarrassingly fast for large volumes, and 'never underestimate the bandwidth of a van full of disks' is still the right answer above a few terabytes on a shared WAN link.

This calculator takes 7 inputs: Evidence to move, Link bandwidth available, Usable share of the link, Encryption overhead, Re-verification hash rate, Courier door-to-door time, Preparation and packaging time. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Yes. Physical transfer needs tamper-evident packaging, encryption at rest on the shipped media, a signed custody form at each handover, and a hash comparison on arrival. The transfer time is the easy part; the custody paperwork is what gets challenged.

Network transfer needs staging and an upload script, which is a fraction of the effort of imaging to shippable media, packaging it, and completing custody documentation — so the model charges the network route a quarter of the preparation time.