What should I preserve when I first receive log evidence?¶

When you first receive log evidence, preserve both the records and the context needed to interpret them.

Avoid this assumption: That saving the visible entries or taking screenshots is enough. It may preserve what you can see, but not the original data, hidden fields, metadata or surrounding records that explain it. Where possible, retain the original export in the format supplied. Do not open and resave it unnecessarily in software that may alter dates, formatting, delimiters or character encoding. Record who supplied it, when it was obtained, how it was transferred and any description given of the system, search terms or filters used.

Preserve the relevant time window rather than only the single entry of interest. Events immediately before and after may show authentication, session creation, retries, automated activity, privilege changes, related requests or the eventual outcome. Ask whether older records are at risk of deletion through retention limits or log rotation and seek urgent preservation where necessary.

Also preserve supporting material. This may include screenshots of the dashboard, the original query, filter settings, report parameters, field definitions, time-zone display, system name, export options and any notes explaining how the records were produced. If the data came from a SIEM or monitoring platform, identify the original source system and whether the displayed record was normalised, enriched or deduplicated.

Avoid changing the source system or running unnecessary searches that could generate new events or overwrite volatile records. Maintain an audit trail of handling and create a working copy for analysis while retaining the original unchanged.

If the export is large, proprietary, live or technically complex, involve the relevant administrator or specialist early. They may need to preserve source logs, configuration, clock information and linked identifiers before they disappear.

Operational takeaway¶

Preserve the original records, surrounding time period, export method, filters, field meanings and source-system context before analysis or retention limits alter the evidence.