Skip to content
ENExplore Calculators

Forensic Storage Requirement Calculator

Work out forensic storage requirement instantly with clear inputs, formula shown and shareable results.

About Forensic Storage Requirement Calculator

Forensic imaging captures full disks bit for bit plus volatile memory, so storage is host count times disk plus memory, multiplied by the number of evidence copies chain-of-custody procedure requires. Compression is usually avoided or applied only to the working copy, since the master must remain a verifiable bit-for-bit image with a matching hash.

Formula

Evidence volume

per host = disk size + memory size; total = per host x hosts x copies; imaging time = total bits / sustained rate

Worked example

With the default values below, Forensic Storage Requirement Calculator returns Total evidence storage of 24.74 TiB. Change any input above and every figure here is recalculated in your browser.

Inputs used

Hosts to imageminimum 1
25
Average disk size per hostminimum 1 GB
512 GB
Memory captured per hostminimum 0 GB
32 GB
Evidence copies retainedone of One working copy, Working copy plus master, Working, master and offsite
Working copy plus master

Results

Total evidence storage
24.74 TiB
Evidence per host
506.64 GiB
Copies retained
2
Imaging time at 200 Mbps sustained
302.2 h

Step by step

  1. 1Values used
  2. 2Evidence volume
  3. 3Total evidence storage= 27,200,000,000,000
  4. 4Evidence per host= 544,000,000,000
  5. 5Copies retained= 2
  6. 6Imaging time at 200 Mbps sustained= 302.2 h

Assumptions and limits

  • The result is derived only from the 4 inputs listed above. Anything not among them is not part of the calculation.
  • In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
  • Figures are rounded for display to 1 decimal place, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

Why capture memory as well as disk?

Encryption keys, injected code, network connections and running processes exist only in RAM. Powering the host off to image the disk destroys that evidence permanently.

Can images be compressed?

The working copy can be. The master should stay uncompressed with a recorded hash so its integrity can be demonstrated independently of any tooling.

Related Calculators

Forensic Storage Requirement Calculator | Calcrivo