What is data preservation and when should I request it?¶
Data preservation is a step taken to prevent relevant cloud records from being deleted through normal retention, user action or account closure.
It does not give the investigator the data. It helps keep it available while the proper lawful process is followed.
What this means in practice¶
Preservation should be considered where the material is relevant, proportionate and at real risk of loss.
Also check whether several providers are involved. The cloud service, identity provider, customer organisation and connected application may each hold separate records.
Preservation is also not a substitute for lawful acquisition. The records still need to be obtained through the appropriate authority and process.
What this may show¶
Cloud logs, deleted items, session records, account changes and security alerts may be short-lived. By the time a formal request is prepared, the records may already have expired.
That may include active account compromise, recent serious offending, volatile login records, deleted content, short provider retention or an account likely to be closed.
What this does not show on its own¶
The dangerous assumption is that a provider will retain everything automatically once an investigation begins.
Where urgency is high, do not let uncertainty about the eventual acquisition route prevent a proportionate preservation request. The purpose is to stop ordinary loss while the correct authority and process are resolved.
What to do next¶
Identify the exact provider, account, tenant, date range and record type. A vague request to “preserve the account” may fail to identify what matters.
Do not assume preservation freezes the live account or prevents the user from continuing activity. It usually affects retention, not ordinary operation.
Record when the need was identified, what was requested and any provider response.
Key takeaway
Request targeted preservation early where relevant cloud records are at risk of ordinary deletion, while continuing the proper lawful process to obtain them.