Forensic Storage Calculator
Size evidence storage for disk images, memory captures and triage packages, with working copies and retention costs.
About Forensic Storage Calculator
Memory is treated separately because it barely compresses — encrypted regions and high-entropy pages defeat it — so it is modelled at roughly half the disk ratio. The strategy factor is the dominant term: targeted collection stores about a seventh of a full image while answering most investigative questions. Evidence volume grows fast during a multi-host incident, and running out of storage mid-acquisition is how chain of custody gets broken and how a working copy accidentally becomes the master.
Formulas
Forensic Storage
Stored GB per endpoint = (disk GB × strategy factor ÷ compression + memory GB ÷ memory compression) × copies.
- strategy factor
- 1.0 full, 0.65 logical, 0.15 targeted, 0.02 triage
- compression
- 1.5–2.5× for E01 or AFF4 on mixed disks
- copies
- Evidence master plus working copies
Retention cost
Retention cost = total GB × price per GB-month × retention months.
- retention months
- How long evidence must be held for legal or regulatory reasons
Worked example
With the default values below, Forensic Storage Calculator returns Total Evidence Storage of 2.705. Change any input above and every figure here is recalculated in your browser.
Inputs used
- Endpoints to acquireaccepts 1–100,000 endpoints
- 25 endpoints
- Disk size per endpointaccepts 1–100,000 GB
- 512 GB
- Acquisition strategyone of Full physical image — 100% of the disk, Logical image of allocated space — ~65%, Targeted collection of key artefacts — ~15%, Triage package only — ~2%
- Targeted collection of key artefacts — ~15%
- Memory captured per endpointaccepts 0–4,096 GB
- 16 GB
- Image compression ratioaccepts 1–10 ×
- 1.8 ×
- Copies retained (evidence plus working)accepts 1–6 copies
- 2 copies
- Retention periodaccepts 1–240 months
- 24 months
- Storage priceaccepts 0–5 $/GB-month
- 0.021 $/GB-month
Results
- Total Evidence Storage
- 2.705 TB
- Stored Size per Endpoint
- 108.19 GB
- Disk Image Storage
- 2.133 TB
- Memory Capture Storage
- 0.571 TB
- Monthly Storage Cost
- $56.80
- Cost Over the Retention Period
- $1,363
- Acquisition Note
- Targeted collection is the pragmatic default — capture memory first, it is volatile
Step by step
- 1Values used
- 2Forensic Storage
- 3Retention cost
- 4Total Evidence Storage= 2.705 TB
- 5Stored Size per Endpoint= 108.19 GB
- 6Disk Image Storage= 2.133 TB
- 7Memory Capture Storage= 0.571 TB
- 8Monthly Storage Cost= 56.80
- 9Cost Over the Retention Period= 1,363
Assumptions and limits
- The result is derived only from the 8 inputs listed above. Anything not among them is not part of the calculation.
- In particular, this calculator does not take inflation, tax or fees or charges into account.
- Figures are rounded for display to 3 decimal places, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.
How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.
Frequently Asked Questions
How is Forensic Storage calculated?
Stored GB per endpoint = (disk GB × strategy factor ÷ compression + memory GB ÷ memory compression) × copies. Memory is treated separately because it barely compresses — encrypted regions and high-entropy pages defeat it — so it is modelled at roughly half the disk ratio. The strategy factor is the dominant term: targeted collection stores about a seventh of a full image while answering most investigative questions.
Why does Forensic Storage matter?
Evidence volume grows fast during a multi-host incident, and running out of storage mid-acquisition is how chain of custody gets broken and how a working copy accidentally becomes the master.
What values do I need to enter?
This calculator takes 8 inputs: Endpoints to acquire, Disk size per endpoint, Acquisition strategy, Memory captured per endpoint, Image compression ratio, Copies retained (evidence plus working), Retention period, Storage price. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Do I need a full disk image?
Rarely, and less often every year. Full imaging of a 2 TB encrypted endpoint takes hours and answers little more than a targeted collection of registry hives, event logs, browser and shell history, prefetch and scheduled tasks — plus memory, which full imaging misses entirely.
Why keep more than one copy?
The master is preserved untouched for integrity and admissibility; analysis always happens on a verified working copy. One copy means the first tool that opens the file read-write destroys the evidence.