Jim_L9
Distinguished
What you are paying the large fees for isn't just the copying of the data. Most people here could easily figure out how to copy that amount if data in less than 20 hours. You are paying for them to:
1. Maintain the chain of custody
2. To do a sector by sector copy
3. To ensure that the evidence drive cannot be written to during the copy
The sector by sector copy has to be done to preserve data that may be file system independent. Suppose you just copy all of the data in Windows, but there was data in a Linux partition. Then you are not truly copying the contents of the data and an evidence technician will not be able to recover all of the original data. Also by copying sector by sector "deleted" information from a file system may be recoverable. If you only do a file by file copy you won't get the deleted files since they won't show up in the MFT of the filesystem. The evidence drive must be protected from write so that the prosecuting attorney can not call into question the validity of data from the source drive.
P.S. The sector by sector copy is what makes this process take so long.
1. Maintain the chain of custody
2. To do a sector by sector copy
3. To ensure that the evidence drive cannot be written to during the copy
The sector by sector copy has to be done to preserve data that may be file system independent. Suppose you just copy all of the data in Windows, but there was data in a Linux partition. Then you are not truly copying the contents of the data and an evidence technician will not be able to recover all of the original data. Also by copying sector by sector "deleted" information from a file system may be recoverable. If you only do a file by file copy you won't get the deleted files since they won't show up in the MFT of the filesystem. The evidence drive must be protected from write so that the prosecuting attorney can not call into question the validity of data from the source drive.
P.S. The sector by sector copy is what makes this process take so long.