How long does it take and will the computer be unavailable during this time?

The amount of time necessary to acquire the evidence depends on the device storing the data. Four hours is a rough estimate with more time required for large or slow devices. If the storage is attached to a critical server that is in use and cannot be taken offline, then a live acquisition can be performed without incurring any downtime. The tradeoff is that this will usually take longer and is not as clean since the evidence is changing as it is being acquired. As for the actual analysis and delivery of the findings, this depends on the evidence being examined. Typically clients receive these results within 4-7 business days of collection.

2016-11-20T00:52:35+00:00

About the Author: