Size evidence storage for disk images, memory captures and triage packages, with working copies and retention costs.
Memory is treated separately because it barely compresses — encrypted regions and high-entropy pages defeat it — so it is modelled at roughly half the disk ratio. The strategy factor is the dominant term: targeted collection stores about a seventh of a full image while answering most investigative questions. Evidence volume grows fast during a multi-host incident, and running out of storage mid-acquisition is how chain of custody gets broken and how a working copy accidentally becomes the master.
Forensic Storage
Stored GB per endpoint = (disk GB × strategy factor ÷ compression + memory GB ÷ memory compression) × copies.
Retention cost
Retention cost = total GB × price per GB-month × retention months.
Stored GB per endpoint = (disk GB × strategy factor ÷ compression + memory GB ÷ memory compression) × copies. Memory is treated separately because it barely compresses — encrypted regions and high-entropy pages defeat it — so it is modelled at roughly half the disk ratio. The strategy factor is the dominant term: targeted collection stores about a seventh of a full image while answering most investigative questions.
Evidence volume grows fast during a multi-host incident, and running out of storage mid-acquisition is how chain of custody gets broken and how a working copy accidentally becomes the master.
This calculator takes 8 inputs: Endpoints to acquire, Disk size per endpoint, Acquisition strategy, Memory captured per endpoint, Image compression ratio, Copies retained (evidence plus working), Retention period, Storage price. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Rarely, and less often every year. Full imaging of a 2 TB encrypted endpoint takes hours and answers little more than a targeted collection of registry hives, event logs, browser and shell history, prefetch and scheduled tasks — plus memory, which full imaging misses entirely.
The master is preserved untouched for integrity and admissibility; analysis always happens on a verified working copy. One copy means the first tool that opens the file read-write destroys the evidence.