Digital evidence is easy to change, sometimes without anyone realising it. Opening a file, signing into an account, installing software or moving data can alter timestamps and activity records. Preservation is about controlling those changes and documenting what happens.
Preserve before examining
Where possible, separate the act of securing evidence from the act of analysing it. The original source should be protected first, with examination performed on an appropriate working copy or forensic image when the circumstances require it.
Document who handled what
Record the device, account or data source, who collected it, the date and time, where it was stored and any actions performed. This creates an audit trail and helps explain how the material was handled.
Keep originals and context
Do not preserve only isolated screenshots or copied text when the original source remains available. Context such as surrounding messages, metadata, file paths and account identifiers can materially change the meaning of evidence.
Use hashes where appropriate
Cryptographic hashes can help demonstrate that a copied file or forensic image has not changed. A hash is not a complete chain of custody, but it is an important integrity check when used correctly.
- Original devices and storage media
- Original files and exports where available
- Relevant account and platform records
- Dates, times and handling notes
- File metadata and folder context
- Hash values for acquired evidence where appropriate
- Browsing through a device casually before preservation
- Renaming or reorganising original files
- Editing screenshots or cropping away important context
- Allowing multiple people to handle evidence without a record