What is preservation?¶

You have identified digital material that may be relevant, but it could change, disappear or be overwritten. Preservation is the action taken to protect that material and its context so it remains available for lawful acquisition, examination and analysis.

Evidential caution: that preservation means making a screenshot or saving a copy wherever convenient. Those actions may be useful, but they do not automatically preserve the original evidence, its metadata, its surrounding records or the system state in which it was found.

What this means¶

Preservation can involve several different things. It may mean preventing unnecessary interaction with a device. It may mean recording a live screen before it changes. It may mean protecting a powered-on system from remote access, while recognising that isolation itself can have consequences. It may mean asking an organisation or provider to retain account, log or cloud records that could otherwise expire. It may also mean retaining the original device or storage medium for specialist handling.

Preservation is not examination. Looking through messages, opening files or navigating an account may create new records, change read status, update timestamps or trigger synchronisation. Nor is preservation the same as acquisition. Acquisition is the controlled process of capturing or copying evidence, ideally in a way that protects its integrity and records how it was obtained.

The correct preservation action depends on the circumstances. Powering a device off may protect it from remote activity but lose memory, sessions or access to encrypted material. Leaving it on may preserve a live state but expose it to battery failure, remote deletion or continuing change. There is no universal rule.

Evidential limits¶

Good preservation includes documentation. Record what was found, when it was found, what condition it was in, what risks were identified, what action was taken, who authorised it, and what changed as a result. If the material cannot be fully preserved, record that limitation honestly.