Forensic Storage Calculator
Size evidence storage for disk images, memory captures and triage packages, with working copies and retention costs.
Inputs
E01 and AFF4 typically reach 1.5–2.5× on mixed disks; memory compresses poorly.
Total Evidence Storage
2.705TB
Stored Size per Endpoint
108.19GB
Disk Image Storage
2.133TB
Memory Capture Storage
0.571TB
Monthly Storage Cost
$56.80
Cost Over the Retention Period
$1,363
Acquisition Note
Targeted collection is the pragmatic default — capture memory first, it is volatile
Step by step
Values used
Endpoints to acquire = 25 endpoints; Disk size per endpoint = 512 GB; Acquisition strategy = Targeted collection of key artefacts — ~15%; Memory captured per endpoint = 16 GB; Image compression ratio = 1.80 ×; Copies retained (evidence plus working) = 2 copies; Retention period = 24 months; Storage price = 0.0210 $/GB-month
Forensic Storage
Stored GB per endpoint = (disk GB × strategy factor ÷ compression + memory GB ÷ memory compression) × copies.
Retention cost
Retention cost = total GB × price per GB-month × retention months.
Total Evidence Storage
= 2.705 TB
Stored Size per Endpoint
= 108.19 GB
Disk Image Storage
= 2.133 TB
Memory Capture Storage
= 0.571 TB
Monthly Storage Cost
= 56.80
Cost Over the Retention Period
= 1,363
How it works
Memory is treated separately because it barely compresses — encrypted regions and high-entropy pages defeat it — so it is modelled at roughly half the disk ratio. The strategy factor is the dominant term: targeted collection stores about a seventh of a full image while answering most investigative questions. Evidence volume grows fast during a multi-host incident, and running out of storage mid-acquisition is how chain of custody gets broken and how a working copy accidentally becomes the master.
Formulas
Forensic Storage
Stored GB per endpoint = (disk GB × strategy factor ÷ compression + memory GB ÷ memory compression) × copies.
- strategy factor
- 1.0 full, 0.65 logical, 0.15 targeted, 0.02 triage
- compression
- 1.5–2.5× for E01 or AFF4 on mixed disks
- copies
- Evidence master plus working copies
Retention cost
Retention cost = total GB × price per GB-month × retention months.
- retention months
- How long evidence must be held for legal or regulatory reasons
Frequently Asked Questions
How is Forensic Storage calculated?
Stored GB per endpoint = (disk GB × strategy factor ÷ compression + memory GB ÷ memory compression) × copies. Memory is treated separately because it barely compresses — encrypted regions and high-entropy pages defeat it — so it is modelled at roughly half the disk ratio. The strategy factor is the dominant term: targeted collection stores about a seventh of a full image while answering most investigative questions.
Why does Forensic Storage matter?
Evidence volume grows fast during a multi-host incident, and running out of storage mid-acquisition is how chain of custody gets broken and how a working copy accidentally becomes the master.
What values do I need to enter?
This calculator takes 8 inputs: Endpoints to acquire, Disk size per endpoint, Acquisition strategy, Memory captured per endpoint, Image compression ratio, Copies retained (evidence plus working), Retention period, Storage price. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Do I need a full disk image?
Rarely, and less often every year. Full imaging of a 2 TB encrypted endpoint takes hours and answers little more than a targeted collection of registry hives, event logs, browser and shell history, prefetch and scheduled tasks — plus memory, which full imaging misses entirely.
Why keep more than one copy?
The master is preserved untouched for integrity and admissibility; analysis always happens on a verified working copy. One copy means the first tool that opens the file read-write destroys the evidence.