Preserve evidence that another analyst can trust

Collect evidence to answer a defined investigative question. Possible sources include endpoint artifacts, memory, packet captures, identity events, cloud audit records, and configuration snapshots. Consider volatility and retention before deciding the order. Some information disappears when a machine stops or a session expires, while other records remain available in durable storage. The best sequence depends on the actual environment and the need to stop harm.

Use authorised tools and procedures, and record the collector, source, time, method, tool version where relevant, and collection limitations. Live collection can alter system state; document that rather than claiming perfect invisibility. Capture enough surrounding context to interpret the event. A single copied log line without its source or time zone may be much less useful than the small, preserved export it came from.

Integrity checks establish whether the bytes being compared are unchanged. Record a suitable cryptographic hash when acquiring an artifact and compare it when transferring or opening an analysis copy. A matching hash supports consistency between those copies. It does not prove that the original source was truthful, that collection was complete, or that the artifact demonstrates the conclusion written in the incident report.

Chain of custody records who possessed or accessed the evidence, when the transfer occurred, and why. Store originals in controlled evidence storage and analyse documented working copies. Protect access records and record derivative artifacts, such as a filtered log set, with their creation method. This allows another analyst to distinguish an original capture from a convenience export that intentionally omits some information.

Preservation includes controlled storage, access restrictions, retention decisions, and protection against accidental deletion or alteration. If a potential legal hold arises, involve the appropriate legal adviser and follow the organisation’s approved preservation instructions. Do not choose an arbitrary retention period or assume that restoring the service ends the need for evidence. Keep sensitive artifacts restricted to the people who need them.

When evidence is incomplete, describe the practical effect on your findings. A missing custody entry, failed hash comparison, or expired log source requires investigation and disclosure, not a silent repair to the record. Preserve what remains, document the issue, and seek an authorised recollection when possible. Conclusions should reflect the available support, especially when an uncertain artifact would otherwise become the sole basis for attribution or impact.