US Patent 11301570 Digital forensics system

A method includes receiving a plurality of sets of extracted data from one or more devices under analysis. An evidence storage server generates a plurality of evidence packages based on a first copy of the plurality of sets of extracted data from the one or more devices under analysis. A virtual desktop server generates one or more virtual desktop sessions that interface with one or more analysis workstations and interface with the evidence storage server to access the first copy of the sets of extracted data in the evidence packages. One or more associated work products are stored in the evidence packages based on a forensic analysis of the first copy of the sets of extracted data in the evidence packages. The one or more associated work products are stored with a second copy of the sets of extracted data to an archive system including a plurality of storage arrays.