Why should investigators preserve the original log source?¶

The original source preserves the best available context and lets extraction and interpretation be checked when screenshots, spreadsheets and converted exports omit or change details.

Later representations can lose evidence¶

Source data may retain hidden fields, order, IDs, metadata and surrounding records. Copying loses context, screenshots crop, CSV flattens structures and dashboards rename values, convert times or group events. Early preservation also protects against rollover, licence changes and cloud retention.

Support repeatability and continuity¶

Record system, tenant, endpoint or service, collector, time, method, filters and displayed zone. Preserve native data and provider exports plus separate working copies and avoid resaving originals for convenience.

Use specialist collection where interaction could alter a live or operationally sensitive source.