In #SANS FOR508 with @robtlee a quick class survey indicates that students spend avg 2 weeks per drive on forensics investigations.

@MalwareJake @robtlee Sounds about right. I wonder if they're including the time it takes to write the report.

@hal_pomeranz @robtlee The question was from phrased 'from acquisition to report' - many commented that it could be much, much longer

@MalwareJake Yeah, I've done "deep dives" on critical systems that have taken months.

@hal_pomeranz @MalwareJake I've had the report alone take much longer than that 2 weeks, but that's more the exception than the norm.

@W3nd1g04n6 @hal_pomeranz Eek. I'd hate for reporting to take that long. I'd fear the result would be a job search...

@MalwareJake @hal_pomeranz Or even more lawyers being involved.