7 ms·

> I think that’s standard procedure already. Simply transferring everything off a 2TB HDD at 100MB/s will take over 5 hours, and that's ignoring any hashing.

• dharmab 8y ago
  I can absolutely confirm that standard procedure is to seize storage media as evidence, send them to a lab and clone the images as the very first step.
  • codetrotter 8y ago
    Another thing I came to think of as well is that they often employ write-blockers, don’t they? Pieces of hardware that go between the computer and the storage media. So by the time decryption is demanded, it will be done with the system in a read-only state right?
    • dharmab 8y ago
      They don't run forensics on the actual device if at all possible, only a read-only cloned image.