Save Money On Forensic Imaging and Data Collection

How to save money on Data Collection

Save Money On Forensic Imaging and Data Collection Costs

We recently had a conversation with an associate of the very prestigious global law firm Denton’s.  She was amazed at the varied data collection quotes (ranging from $1000-$5000) she received from vendors in the Tampa Bay area. That conversation inspired this blog post. Herein we explain some of the costs associated with forensic data collection.  We also provide a few questions you may want to ask a data preservation vendor before you hire them.

Forensic Imaging Software 

  • Assuming the vendor is qualified, the first item associated with the cost of forensic imaging is the hardware and software used to collect the data. FTK, Encase, and other software companies offer forensic imaging software at no cost.  The forensic imaging software has to be used with a computer and a write blocker, which protects the source media from contamination. This method of collection is often slower and more costly when compared to using a “stand-alone” forensic imaging hardware.  We use the Tableau TD1, TD2 and The Voom Hardcopy 3p stand-alone forensic imagers.
  • A vendor using a laptop and write blocker is costing you money. Less reputable vendors will intentionally use this method simply to generate more billable hours.
  • A vendor using free forensic software and a free software write blocker is inexperienced. In addition to potentially compromising the original, you may later learn that your forensic image is useless. The forensic image is the cornerstone of preservation and admissible evidence.

Question #1: Ask the vendor which tools and methods they use to collect data.

Forensic Data Collection of a hard drive using write blocker

Forensic Data Collection of a hard drive using write blocker

Standalone Forensic Imaging Hardware

  • Standalone forensic imaging devices such as Voom’s Hard Copy 3p  offer the forensic expert the ability to quickly create multiple verified images of a single source drive at the same time. Typically one copy is used during the examination. The second verified copy is stored in evidence, shipped to the client, or provided to the opposition if needed. The second copy is also a spare in the event the first copy is damaged, compromised or fails.

Question number two should be, how many forensic images will you create per source media?

Storage Media Cost

  • Storage media is the next expense associated with the forensic imaging process.  Some vendors will generate one forensic image to a single hard drive, then bill the client for the cost of each drive.  For example copying one 500 gigabyte image to a 2 terabyte drive, verses copying three or four 500 gigabyte images to one 2 terabyte drive.  Vendor “A” would charge you for four hard drives where vendor “B” would charge you for only one.

Question number three should be, do you  use a single hard drive per image or multiple images on a single hard drive? 

Sanitizing and Wiping Client Data

  • In some cases the vendor is asked to make multiple forensic copies. One to be shipped to the client and the second to be held onto until the first copy is received and re-verified. Hard Drives that are recycled by the vendor must be sanitized before they can be used for the next client.  This process can take up to 4 hours for a 268GB hard drive. Not only does this make the drive unavailable for use, there is a behind the scene labor cost associated with the process. Additionally drive sanitizing hardware is expensive.

Will your data collection project be subcontracted?

  • It’s been my experience that when a client receives an outrageous quote for forensic data collection, the excessive estimate is usually the result of the work being outsourced to a third party.  A national brand is usually a fancy way of not saying, we use subcontractors. Your cost is marked-up from there.

Question number four, will your companying be doing the work or do you use subcontractors?

An experienced vendor can estimate your cost and won’t go over unless there is some unknown variable. Other costs are based on demographics. Competitive markets have companies that offer reduced prices. For example, we offer discounts to data collection if we conduct the analysis.

Now that you understand the cost associated with data collection, and what to ask, call us! Data Specialist Group of Tampa, FL offers fast competitively priced data collection. 888-747-6855