What should be preserved before relevant records disappear?¶
title: "What should be preserved before relevant records disappear?" card_id: "IP-076" status: "complete" source_document: "https://docs.google.com/document/d/11A0oYCAFTx5dNzsKIK9Uq3_JyF54_wqCYTlFsuMmygk/edit?usp=drivesdk"
What should be preserved before relevant records disappear?¶
IP attribution often depends on records that are retained for a limited period.
If those records disappear, a technically promising line of enquiry may become impossible.
The first priority is the originating record.
Preserve the event or export that actually contains the IP address, rather than relying on a screenshot, copied value or summary.
Keep the full timestamp, time zone, field labels, source and destination information, ports, protocol and any account, event or session identifiers.
Those surrounding fields may determine whether a provider can perform a match later.
The platform that created the record may hold additional activity, login or session information.
An internet provider may hold dynamic-address allocations. A CGNAT or mobile provider may hold short-lived translation or session logs.
A workplace, venue or public Wi-Fi operator may retain DHCP, authentication, Wi-Fi, firewall or proxy records for only a limited time.
VPN, proxy and hosting providers may have their own retention periods—or may not create the hoped-for records at all.
Relevant devices can change too.
Browser history, caches, application records and temporary network information may be overwritten through ordinary use.
Preservation doesn't mean assuming that every possible source should be retained.
The action should relate to a clear investigative question and the records likely to answer it.
It is also important to distinguish preservation from acquisition.
A preservation step asks that existing data isn't routinely deleted while the correct process for obtaining it is considered.
It doesn't prove what the records contain, guarantee that useful data exists or replace the appropriate legal authority for disclosure.
The exact preserved scope and time period should be recorded.
Overly narrow preservation may miss the relevant event. An unnecessarily broad request may be difficult to justify and may obscure what is genuinely needed.
Preservation protects the possibility of obtaining evidence later.
It doesn't complete the attribution, but failing to preserve time-sensitive records can end it before the proper questions are asked.