The answer depends on numerous factors. This is why it’s important to call us and talk to our project manager about the evidence to be recovered. Once we understand your case and the evidence you need, we can give you a ballpark estimate of timing for planning purposes. The volume of data on the devices, how much searching and filtering is needed, and what other analyses are required will influence the time required.  The good news is the initial step, forensically copying, or imaging, the hard drive(s) can be performed in just a few days and then returned to you or your client.