When running this forensic copy, there's no issues of file names, no issues of deep paths, no weird characters, none of it. The imaging program does the whole thing in a brute force manner.

It's also much faster and less complex to run. Generally you load the image program, tell it the source drive, tell it the destination drive, click copy and go to lunch. When you come back from your (long, two hour) lunch, it's done.

I use an off-the-shelf product, Symantec's $70 Ghost program to image our drives here at ZATZ and I do it as a matter of course, just to make sure we've got good copies if we need them. It's easy, it works, and it's certainly not all that complex. Disclosure: I was an exec at Symantec back in the '80s.

Bottom line: Making forensic copies does take time, but it's not hard at all.

It'll interrupt workers
One response by Payton, on the surface, seems to be a potential show-stopper.

To complete this effort, it might require contacting and using the workstations currently assigned to individual users, which likely would adversely impact the ability of the users to perform their duties.

None of us like the downtime that comes from having a PC worked on. We've all experienced it. And, of course, we don't want White House workers to be taken away from their important jobs just to make copies of their hard drives.

But it doesn't have to be that way. Just about any hard drive can be imaged in a few hours. Most of the computers at the White House lie unused for at least 12 of each 24 hours -- when their users are commuting to and from work, are out on the town for their evenings off, or home, cozy in their beds, dreaming dreams of a safer world.

So it'd be quite simple for a team of IT professionals to come in at night and image those drives. After all, most of us IT people are creatures of the night anyway -- not in the cool vampire way, but in that oh-so-geeky staying up all night to reach level 70 World of Warcraft way.

Bottom line: Avoid disturbing workers by doing forensic backup work at night.

It'll cost a lot
Finally, according to Payton, they can't really determine how much this project will cost, because it's a big job:

And, as with any procurement project, in addition to outside resources, OA resources would be needed in order to effectively manage the effort. The precise duration of the procurement process, as well as costs associated with that process, are not presently knowable, but they must be expected to be substantial given the sensitivity and significance of such a project.

If you read my last article, you'll see that Payton was quoting $50,000 for a single item restore and half a million dollars for servers. She estimated the project would cost $15M or more.

I believe the cost of this project is knowable, and can be estimated quite easily. After all, we know the prices for computers and we know the price for people time, so we can certainly extrapolate the full cost with some degree of accuracy.