Digital evidence storage question

I've had many different experiences with 'how' the data is stored long term. Archives of case data that includes reporting, original evidence, and working data (encase, axiom, FTK, whatever the platform you're using for analysis etc) can be stored on a large NAS, external drives, tape, flash drives, so long as there's a system for it. All have advantages and disadvantages because of reliability of the data long term, time to restore & accessibility, so that sort of depends on how much you can afford to spend on it and the size of ty data. If it's critical to hold the data then multiple copies on multiple mediums. There's not really a one size fits all solution and I think cost and time are a huge factor in the choice.

I would also say that it's just as important to have a written policy regarding data retention time length and return of original evidence and / or documented distuction of that data. Something like x months or years for original evidence, and reporting unless otherwise agreed to. Obviously these things can depend on the industry and data type, but while you're on the subject this is also very, very important.

/r/computerforensics Thread