What is the difference between preservation and acquisition?¶

Preservation protects evidence from avoidable loss or change. Acquisition is the controlled process used to capture or copy it. A source can be preserved without yet being acquired, and a convenient copy is not necessarily a complete acquisition.

The stages answer different questions¶

Preservation asks: how can the source and its context remain available? A phone may be secured for specialist handling, or a provider may retain account records pending the correct disclosure route. Neither action necessarily supplies the data for examination.

Acquisition asks: what was collected, from which source, at what time, by whom and through what method? It may produce a forensic image, logical extraction, native export, provider return or live-memory capture. Scope, errors and known omissions belong in the acquisition record.

Ordinary copying may leave behind metadata, hidden content, deleted data, database relationships or provider records. It can also alter the source if a user must open, export or synchronise material to create the copy.

Preserve before choosing the capture method¶

First responders should separate the immediate risk of loss from the later collection method. Unnecessary attempts to obtain data can lock a device, terminate a session, alert another user or overwrite information. Photographs and screenshots may protect a transient observation without authorising wider exploration.

The distinction also keeps limitations visible. A retained device has not necessarily yielded readable data; an exported conversation may not represent the whole account. Examination begins only after material has been acquired through an understood process.