What is the difference between preservation and acquisition?¶

You have found digital material that may matter, and someone says it has been “preserved” because a copy was taken. That may be true, but preservation and acquisition are different stages and should not be treated as the same thing.

Evidential caution: that copying digital material automatically preserves it. A copy may omit metadata, hidden content, deleted material, system context, account records or evidence of how the original was stored and accessed. It may also change the source if it was created through ordinary navigation or export.

What this means¶

Preservation is about protecting potential evidence from avoidable alteration, deletion or loss. It begins when the material is identified and may include recording the original state, limiting interaction, retaining a device, preventing overwriting, isolating a system where appropriate, or asking a provider or organisation to retain records.

For a first responder, the distinction matters because preservation usually comes first. Unnecessary attempts to obtain the data can alter the source, lock the device, terminate sessions, trigger alerts or create new records. Screenshots and photographs can support preservation, but they rarely replace a proper acquisition where native data is important.

When deciding what to do, ask two separate questions: how do we stop this evidence being lost, and how should it later be captured in a controlled and lawful way?

Evidential limits¶

Acquisition is the controlled capture or copying of that evidence. Depending on the source, it may involve a forensic image, a logical extraction, a provider return, a native export, a live-memory capture or another specialist method. The acquisition should record what was collected, from where, by whom, when, using what method and with what limitations.

A preserved item may not yet have been acquired. For example, a phone may be secured and retained without its data being extracted. A provider may preserve account records pending lawful process without disclosing them. Equally, an acquisition may be incomplete even though a copy exists.