What is preservation?¶

Preservation protects potentially relevant digital material and its context from avoidable change or loss so that it remains available for lawful acquisition and examination.

Preservation protects an opportunity¶

The appropriate action depends on the source and the risk. It may mean limiting interaction with a device, recording a live screen, retaining storage, preventing records from being overwritten or asking a provider to hold short-lived account and log data.

A screenshot or convenient copy can preserve visible information, but it may omit metadata, surrounding records and the original system state. Preservation therefore concerns more than content: it protects the relationships and conditions needed to interpret that content later.

Preservation is not examination. Navigating messages, files or account settings can create audit events, update timestamps, change read status or trigger synchronisation. It is also distinct from acquisition, which captures material through a defined method.

The action must fit the live risk¶

There is no universal rule for a powered device. Switching it off may stop remote activity but lose memory, sessions or access to encrypted storage. Leaving it on may retain those features while allowing battery failure, remote deletion or continuing system change.

Record the state found, the risks identified, the decision-maker, the action and its effect. If the ideal material could not be protected, state what may have changed or disappeared. Transparent limits are part of preservation, not evidence of failure.