What should be preserved immediately?¶

Immediate preservation should focus on evidence that is volatile, short-lived or likely to be changed by response activity.

Evidential caution: that the safest response is either to seize everything immediately or to leave everything untouched.

What this means¶

Both can be wrong.

Then identify live or short-retention evidence. This may include active sessions, memory, running processes, network connections, endpoint telemetry, authentication records, cloud audit logs, email-security records, proxy logs and copies of malicious content.

Where relevant, preserve:

the affected account and device identifiers;

the exact time period and time zone;

the original malicious file or link;

copies of phishing pages or ransom notes;

configuration and retention information;

the names and roles of people who collected or interpreted the data;

details of password resets, session revocations, isolation, shutdowns and rebuilds.

Where a technical action may change the source, record the action before it occurs and document its effect. Specialist support may be required for live systems, encrypted devices, active malware, cloud environments or business-critical services.

Preservation is not the same as proving admissibility or meaning. It protects the opportunity for later examination.

================================================================================

What to check or do next¶

• Start by preserving the material already available: alerts, reports, emails, screenshots, incident tickets and original files. Record where each item came from.
• Preserve the organisation’s own response record. Incident tickets, chat messages, call notes, decisions, containment actions and recovery steps may later be essential for reconstructing the timeline.
• Do not demand indiscriminate copying of every system. Collection should be proportionate and directed by the investigative questions, likely evidential value and risk of loss.