Why should investigators preserve the original log source?¶
Investigators should preserve the original log source because later exports, screenshots and summaries may omit detail or change how the evidence appears.
The original source provides the best available reference point for checking what the system actually recorded.
Avoid this assumption: That a spreadsheet, screenshot or copied line contains everything that may later matter. It may not.
The original source may preserve hidden fields, event ordering, identifiers, formatting, metadata and surrounding records. Those details may become important when a timestamp is challenged, an event must be correlated or an apparent contradiction needs to be explained.
A copied entry can lose context. A screenshot may crop fields. A CSV export may flatten nested data. A dashboard may rename values, convert times or combine several source records into one display.
Preserving the source also allows another person to repeat the extraction or check whether filters were applied. That supports continuity, review and defensible reporting.
In some systems, the original source is volatile. Logs may roll over, retention may expire and cloud records may disappear when a licence changes. Preservation should therefore be considered early rather than after interpretation has begun.
Investigators should record the system, account, tenant, device or service from which the logs came. Note the date and time of collection, the person who performed it, the method used, filters applied and the time zone shown.
Where possible, preserve the native file or provider-generated export as well as any working copy. Do not overwrite or re-save the original simply to make it easier to read. Obtain specialist support where collection could alter the source or where the system is live and operationally sensitive.
Operational takeaway¶
Preserving the original log source protects context, repeatability and evidential detail that may be lost through screenshots, copying, filtering, conversion or later system changes.