Forensic Evidence Storage Calculator

provisionedCapacity = (retainedImages + derivedArtefacts + liveWorkingCopies) × copyCount × 1.25 headroom, where retainedImages = devices × capacity ÷ compression × retentionYears. Evidence at rest is never just the image. Each case holds a compressed acquisition kept for the full retention period, one or more uncompressed working copies mounted while the case is live, and derived artefacts — carved files, search indexes, timelines — that typically add a quarter of the image again. Only the images and artefacts accumulate over the retention window; working copies are released when a case closes, so they are counted for one year of active load.

Forensic storage grows monotonically for as long as the retention policy says, and an array that fills mid-acquisition corrupts the one copy you were legally required to preserve.

This calculator takes 8 inputs: Devices acquired per year, Average device capacity, Image compression ratio, Working copies kept per case, Derived artefacts as a share of the image, Retention period, Keep a second offsite copy, Storage cost per TB per month. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Usually not. Analysis tools random-read the image constantly, and decompressing on every read is slow enough to dominate the case timeline. Keep the archive compressed and the active working copy raw.

Chain-of-custody and disaster-recovery obligations. If the only copy of an acquisition lives on one array, a controller failure destroys evidence, so most labs treat 2× as a floor and price it in from the start.