A digital forensics system, comprising: an ingestion system comprising one or more ingestion workstations operable to receive a plurality of sets of extracted data from one or more devices under analysis; an analysis system comprising one or more analysis workstations; an archive system comprising a plurality of storage arrays (126, 128); and a server system comprising: an evidence storage server comprising a first plurality of processing and memory resources operable to generate and store a plurality of evidence packages (130A-C) comprising a first copy of the sets of extracted data from the one or more devices under analysis; and a virtual desktop server comprising a second plurality of processing and memory resources operable to generate one or more virtual desktop sessions that interface with the one or more analysis workstations of the analysis system and interface with the evidence storage server to access the first copy of the sets of extracted data in the evidence packages (130A-C), store one or more associated work products in the evidence packages based on a forensic analysis of the first copy of the sets of extracted data in the evidence packages, and store the one or more associated work products with a second copy of the sets of extracted data to the archive system; wherein: the ingestion system is operable to cryptographically hash each of the first copy of the sets of extracted data and the second copy of the sets of extracted data, to verify authenticity and an absence of modification; the virtual desktop server is operable to provision the one or more virtual desktop sessions with a predetermined configuration and toolset operable to perform the forensic analysis based on a data source device type of the sets of extracted data; and the virtual desktop server is operable to provision a new instance of the one or more virtual desktop sessions for each new analysis session. an ingestion system comprising one or more ingestion workstations operable to receive a plurality of sets of extracted data from one or more devices under analysis; an analysis system comprising one or more analysis workstations; an archive system comprising a plurality of storage arrays (126, 128); and a server system comprising: an evidence storage server comprising a first plurality of processing and memory resources operable to generate and store a plurality of evidence packages (130A-C) comprising a first copy of the sets of extracted data from the one or more devices under analysis; and a virtual desktop server comprising a second plurality of processing and memory resources operable to generate one or more virtual desktop sessions that interface with the one or more analysis workstations of the analysis system and interface with the evidence storage server to access the first copy of the sets of extracted data in the evidence packages (130A-C), store one or more associated work products in the evidence packages based on a forensic analysis of the first copy of the sets of extracted data in the evidence packages, and store the one or more associated work products with a second copy of the sets of extracted data to the archive system; wherein: the ingestion system is operable to cryptographically hash each of the first copy of the sets of extracted data and the second copy of the sets of extracted data, to verify authenticity and an absence of modification; the virtual desktop server is operable to provision the one or more virtual desktop sessions with a predetermined configuration and toolset operable to perform the forensic analysis based on a data source device type of the sets of extracted data; and the virtual desktop server is operable to provision a new instance of the one or more virtual desktop sessions for each new analysis session. an evidence storage server comprising a first plurality of processing and memory resources operable to generate and store a plurality of evidence packages (130A-C) comprising a first copy of the sets of extracted data from the one or more devices under analysis; and a virtual desktop server comprising a second plurality of processing and memory resources operable to generate one or more virtual desktop sessions that interface with the one or more analysis workstations of the analysis system and interface with the evidence storage server to access the first copy of the sets of extracted data in the evidence packages (130A-C), store one or more associated work products in the evidence packages based on a forensic analysis of the first copy of the sets of extracted data in the evidence packages, and store the one or more associated work products with a second copy of the sets of extracted data to the archive system;