Glossary · E
Evidence preservation
Evidence preservation is the handling of logs, images, communications and artifacts during an incident so that they remain complete, unaltered and admissible for investigation, insurance, regulatory and legal purposes.
Extended definition
In more detail.
Well-meant response actions destroy evidence: rebuilding a server, deleting a mailbox, restarting a device. A preservation workflow defines what to capture, how, in what order and under whose custody, before containment proceeds. It protects the organization’s position with its insurer, in litigation and in front of regulators, and it is designed before the incident, not during it.
In our work
Where it appears.
By David Selakovic · Published 2026-10-16 · Revised 2026-10-16 · Reviewed every 180 days