Question
Are the original evidence files needed after indexing / processing them into a case?
Answer
Yes, it is recommended to store the original evidence files even after indexing / processing them into a case as they might be needed for future re-indexing purposes, referencing, integrity and maintenance. Many users like to keep their evidence data on an external drive.
When indexing a source, you have the option "Cache original evidence files". If this option is selected, the files from the evidence folder will be copied to the case folder.
However, keeping the original evidence files generally impacts two things: Exporting and re-indexing.
For exporting:
The original files are always required. This is because re-indexing starts with deleting the case's contents, including anything that may have been cached.
However, keeping the original evidence files generally impacts two things: Exporting and re-indexing.
For exporting:
- When you have enabled the "Cache original evidence files" option, the case is now self-contained and the original evidence files are not needed anymore.
- When you have disabled the "Cache original evidence files" option, and a binary file of an item is needed for exporting, then those that were originally already present as files in the evidence folder, will be obtained from that location.
The original files are always required. This is because re-indexing starts with deleting the case's contents, including anything that may have been cached.