Solution Guide

Store 67
Figure 4-1. Tiered Storage Usage for Archiving and Retrieval
Figure 4-1 shows the suggested path for storage of digital evidence from the
time that evidence is collected to its eventual long-term storage on tape or final
deletion.
Matching Evidence Archiving and Retrieval to the
Life of the Case
Evidence Seizure (Analyze) – When the digital device is first seized, a high tech
crime lab will normally want to get the potential evidence off of the device as
quickly as possible and start the analysis process. The faster an analyst can
search and index an evidence file, the quicker a decision can be made whether to
progress the case or not.
Evidence Identification (Present) – When evidence has been potentially found
during the analysis stage, different skill sets may now be required (Language,
technical drawings, accounting, etc.). The evidence now needs to be categorized
by the viewing teams. The heavy processing is now over so the evidence can
reside on slower more cost-effective long term storage.
Waiting for Trial (Archive) – After all the potential evidence has been gathered
and the case is proceeding, normally there is no need to keep the case data and
evidence images in online storage, where it can be accessed instantaneously. In
normal cases, the lab will be able to cope with case recall time of days, which
may be done proactively if a known forward event will trigger the need for the