What should I preserve when I first receive log evidence?¶

Preserve the original records and the production context: source system, surrounding period, query, filters, fields, time basis, export method and handling history.

Keep the source and enough sequence¶

Retain the supplied format unchanged and create a working copy. Record supplier, receipt and transfer. Preserve events before and after the item of interest because authentication, retries, automation and outcome may sit outside a selected row. Consider rotation and retention risk promptly.

Preserve how the view was produced¶

Keep dashboard captures, exact query, report parameters, hidden fields, zone display and export options. Identify whether a SIEM normalised, enriched or deduplicated source data and avoid searches or changes that create events or overwrite volatile records.

For proprietary, large or live sources, involve an administrator or specialist early to retain configuration, clocks and linked logs.