What Is Evidence Preservation?

Evidence preservation is the set of actions that stop relevant data being destroyed, altered or overwritten once an incident is suspected. It is decided in the first minutes, usually by people who are not thinking about evidence.

The instincts that make sense operationally — reboot it, rebuild it, clean it up, get the service back — are the ones that destroy what an investigation needs.

What destroys evidence fastest

Powering a system off, which erases memory. Rebooting, which does the same and overwrites temporary state. Rebuilding or reimaging, which removes everything. Running antivirus cleanup, which deletes the malware before it can be analysed.

Also: restoring from backup over the affected system, normal log rotation aging out the relevant period, and automated processes that recycle cloud resources on a schedule.

What to do instead

Isolate rather than power down — remove network access and leave the system running. Capture memory if the capability exists. Suspend log rotation and extend retention on anything relevant.

Snapshot virtual machines and cloud volumes before changing anything, since a snapshot is fast, non-invasive and reversible. And stop any automated process that would recycle, scale down or terminate the affected resources.

Legal hold, and why it extends past systems

Where litigation or regulatory action is foreseeable, obligations to preserve attach to more than the compromised machine: relevant email, chat messages, ticketing records and documents all fall in scope.

Routine deletion policies that would otherwise remove that material need suspending, and the suspension needs to be instructed explicitly. Automated retention rules do not pause themselves, and their continuing to operate after a hold is a problem of its own.

Preservation and containment can conflict

Containment sometimes requires actions that damage evidence, and stopping active harm generally wins. The resolution is sequencing rather than choosing: capture what can be captured quickly, then contain.

Where that is not possible, recording what was done and why preserves the explanation even when it cannot preserve the evidence. An investigator who knows a system was rebuilt at a given time can work around it; one who discovers it later cannot.

Retention is preservation done in advance

Most preservation failures are not mishandling during an incident. They are logs that were never kept long enough, telemetry that was never collected, and cloud audit records left at default retention.

Nothing done during response recovers data that was never retained, which makes retention settings the highest-leverage preservation control available.

Evidence held by third parties

A growing share of relevant evidence sits with providers rather than on your systems — email platform audit logs, cloud control plane records, managed application access logs. Those have their own retention periods, frequently short, and their own request processes.

Requesting preservation from a provider early is worth doing even before you know whether the data matters, because the request costs little and the retention window does not pause for your investigation. Knowing which providers hold what, and how to ask, is preparation rather than response work.

Where to start

Write a short first-responder card: isolate, do not power off, snapshot, log what you did, escalate. Most evidence loss happens in the first hour to people acting reasonably without guidance.

See chain of custody. GuardsArm delivers incident response.