Preservation is the disciplined act of protecting potentially relevant material before interpretation, organization, or analysis changes its original condition or context.
In investigative, legal, and information-sensitive matters, the earliest handling decisions can affect what remains available for later review. A file can be overwritten, a message can disappear, a device can synchronize new data, and a physical item can lose useful context through unnecessary handling.
The objective is not simply to keep a copy. Effective preservation considers the original source, surrounding information, storage environment, handling history, and the intended use of the material.
Preserve first. Interpret second. The opportunity to analyze may remain; the opportunity to protect the original information may not.
What Evidence Preservation Means
Evidence preservation involves reasonable measures to protect potentially relevant information or items from loss, alteration, contamination, destruction, or separation from their source context.
Depending on the matter, preservation may involve:
- Messages, emails, attachments, and call records
- Photographs, video, and audio recordings
- Documents, reports, notes, and correspondence
- Computers, phones, removable media, and storage devices
- Cloud-based files and account information
- Social-media content and web-based records
- Metadata, timestamps, and source information
- Physical items associated with an event or allegation
Not every preserved item will ultimately be relevant or formally treated as evidence. Preservation protects the opportunity for an authorized reviewer to make that determination later.
Why Preservation Should Precede Interpretation
It is natural to open files, search devices, reorganize folders, enhance photographs, forward messages, or annotate documents when trying to understand a matter. Each action, however, may alter the material, its metadata, or the record of how it was originally found.
Preservation creates a stable starting point. It allows subsequent review to occur against an identifiable source and helps separate the original material from later notes, working copies, summaries, and analytical conclusions.
A working copy may support review, but it should remain distinguishable from the original or best available source. Record when the copy was created, how it was created, and what—if anything—was changed.
Digital Evidence Requires Particular Care
Digital information can change through ordinary use. Opening an application, connecting a device to a network, allowing cloud synchronization, installing software, exporting a conversation, or resetting an account may create new data or alter existing information.
Screenshots are useful for reference, but they do not necessarily preserve the complete record. They may exclude metadata, account identifiers, earlier or later messages, file properties, embedded information, and the original relationship between data and device.
Avoid self-directed extraction or recovery attempts when the material may be important.
Do not reset, update, repair, unlock, search extensively, install recovery tools, or continue using a potentially relevant device without understanding the possible effect. The appropriate preservation method depends on the device, data source, authority, and intended use.
NIST notes that digital evidence presents preservation problems beyond those associated with traditional evidence. When the material may affect litigation, an investigation, or an important organizational decision, qualified guidance should be considered early.
Documentation Protects Source and Context
Preservation is not limited to retaining the item. A useful record should explain what was preserved, where it came from, when it was identified, who handled it, and what actions were taken.
Good documentation may include:
- Date and time the material was received or identified
- Description of the item, file, account, or information
- Original location or source
- Name of the person who supplied or collected it
- People who handled or accessed it
- Method used to copy, export, package, or store it
- Original file names, identifiers, and relevant timestamps
- Any observed changes, limitations, or irregularities
Notes should be made close in time to the handling event and should distinguish direct observations from information supplied by another person.
Understanding Chain of Custody
The National Institute of Justice describes chain of custody as a recorded means of verifying where evidence traveled and who handled it. The record helps account for receipt, transfer, storage, access, and disposition over time.
Formal chain-of-custody requirements depend on the setting, governing procedures, and intended legal or administrative use. A personal handling log can support clarity and accountability, but the required process should be established by the responsible agency, attorney, laboratory, court, or other authorized professional.
Limit unnecessary handling. When custody changes, document the date, time, transferring person, receiving person, item description, and purpose of the transfer.
Common Evidence-Preservation Mistakes
Well-intended actions can reduce the usefulness of potentially relevant material. Common problems include:
- Deleting messages, files, posts, or call history
- Editing, cropping, enhancing, or renaming original files
- Resetting, updating, repairing, or replacing a device
- Forwarding content without retaining the original record
- Combining original files with working copies
- Failing to record source, date, time, and handling
- Allowing unrestricted access to sensitive materials
- Cleaning, moving, marking, or unnecessarily handling physical items
- Posting potentially relevant material publicly
- Attempting recovery or forensic work without proper tools or authority
If a mistake has already occurred, document it accurately. Concealing or reconstructing the handling history can create greater problems than acknowledging a known limitation.
When Professional Review May Be Appropriate
Professional assistance may be useful when a matter involves digital devices, large record sets, disputed facts, time-sensitive information, multiple sources, or materials that may be used in litigation or an official investigation.
OISEA may assist with reviewing available materials, organizing records, developing evidence inventories and timelines, documenting source context, identifying information gaps, and determining whether specialized examination should be considered.
The appropriate next step depends on the material, the client’s authority, the purpose of the review, and any instructions from counsel, law enforcement, a court, or another responsible entity.
Authoritative preservation resources
NIST Digital Evidence Preservation
National Institute of Justice: Chain of Custody
Preservation Protects the Opportunity for Reliable Review
Evidence preservation matters because information can be lost quickly and unintentionally. Protecting the original or best available source, documenting how it was handled, and limiting unnecessary changes create a more reliable foundation for later analysis.
Preservation does not determine what the material proves. It helps ensure that important questions can be evaluated with clearer records, better context, and fewer avoidable uncertainties.
This article provides general information and does not constitute legal advice, forensic examination, laboratory analysis, or a determination of authenticity or admissibility. Preservation procedures should be selected for the circumstances and intended use of the material.