Doctorow states that the most important commodity in today's economy is attention [1]. Each person only has 24 hours in a day to send messages, surf the net, watch video and shop online. Hence, even though the size of hard drives has increased 100 fold from 10GB in 1999 to 1TB in 2013 [2], we have most definitely not increased the amount of messages sent, websites visited, videos watched and items bought online by 100 fold, the latter also being constrained by the fact that salaries have not increased 100 fold in that time!
Since the amount of meaningful data has not exploded in volume, I do believe that the "data reduction and subsets" strategy [3] highlighted by Quick et al is critical to ensure that we are able to cope with the increase in disk and file sizes. Selective imaging by skipping over file hashes of known binaries or media files could greatly reduce the amount of data processed [4]. Spotify has been known to cache up to 8 GB of audio recordings [5], we could skip over the cache folder as the Listening History will give you all that information in a file only a few KB in size. However, savvy criminals with knowledge of the forensics process may decide to hide incriminating files there, hence forensics analysts will also need to make a determination if a deeper search is warranted based on the profile of the perpetrator. This will require both a legal and technological shift in processes. Courts will have to accept evidence from partial images and forensics tools will need to support such functionality.
One silver lining from increasing data volume is the increased retention as "storage is easily purchased and inexpensive" [6]. Hence, data that might have been deleted and overwritten by perpetrators may now be available for collection. Also, there is a corresponding increase in "machine generated" data since machines do not have to divide their 24 hours into various tasks. For instance, CCTVs that previously only capture a few days of data can now capture months of data. This provides additional lines of investigations which may not have existed previously.
Finally, the disk size of the average personal computer sold today has plateaued at around 1TB, similar to 2013. Even though there are larger disk sizes available, the market has settled on that number possibly due to Doctorow's conjecture above. With only 24 hours a day, there is a limit to how many videos we can watch. There is no purpose in storing terabytes of videos that we'll never find the time to watch, not to mention the rise of the popularity of streaming services which negate the need for storage.
[1] Cory Doctorow (2020) 'How to Destroy Surveillance Capitalism' (OneZero 2020), pp. 20
[2] Quick D and Choo K-KR, 'Impacts of Increasing Volume of Digital Forensic Data: A Survey and Future Research Challenges' (2014) 11 Digital Investigation 273, pp. 276
[3] ibid, pp. 282
[4] ibid, pp. 284
[5] petalfo, 'How to limit cache size?' https://community.spotify.com/t5/Desktop-Mac/How-to-limit-cache-size/td-p/2907725 accessed 1 Mar 2025
[6] Quick D (n 2), pp. 279
[7] HP, 'Specifications of Personal Computers Over Time' https://www.hp.com/gb-en/shop/tech-takes/specifications-personal-computers-over-time accessed 1 Mar 2025