Digital evidence is altered by normal use. Booting a computer updates records. Opening a file may change metadata. Forwarding an email changes its headers. Removing a cloud license can change retention. A defensible response begins with a short pause to identify the source, its state, and the least disruptive preservation method.
Preserve Source Records Before Routine Changes
Record identifiers and condition, then preserve through an appropriate forensic image, native export, provider hold, or targeted collection. Work from a validated copy where the source and acquisition method permit. For cloud, mobile, volatile, or live system work that calls for a different acquisition, record the access, method, time, unavoidable changes, and resulting limitations.
Get Preservation Guidance First
Tell us what source you are about to touch. A senior examiner will tell you how to preserve it on a free call.
Document Exceptions, Custody and Collection Scope
A screenshot shows what a user saw, and the native source is where the examiner looks for metadata, hidden fields, message routing, edit history, file structure, and surrounding context. Preserve the screenshot when it matters, then obtain the native message, file, database, device, or platform export where possible.
Typical work replaces forwarded email with native preservation, preserves each device before any reset, reimage, or reassignment, checks retention effects before licenses are removed or accounts deleted, and keeps provenance for evidence drawn from several sources.
Write Down the Exception While It Is Happening
Access failures, unsupported devices, missing logs, corrupted media, overwritten records, unavailable custodians, and emergency changes belong in the preservation record. Recorded at the time, each one is straightforward to explain later.