Insights · Field note · Security assurance and compliance
Evidence preservation during an incident
The instinct is to fix it. The first actions of a well-meant response are often the ones that destroy what the insurer, the regulator and counsel will need.
Evidence preservation during an incident is the handling of logs, system images, communications and artifacts so that they remain complete, unaltered and usable for investigation, insurance claims, regulatory response and litigation. Rebuilding a server, deleting a compromised mailbox, restarting a device or wiping a laptop each destroys evidence, and each is a natural first reaction. A preservation workflow decides in advance what to capture, in what order, by whom and under what custody, before containment proceeds. NIST SP 800-86 covers integrating forensic practice into response; the workflow is the organization’s version of it.
In detail
What the evidence shows.
What is lost and how
Volatile memory lost on restart. Logs overwritten by retention. Mailbox contents deleted to stop the attacker. Disk images altered by rebuilding. Timeline lost because nobody recorded when each action happened. Each loss weakens the investigation and the organization’s position with its insurer and in any dispute.
Order of operations
Capture before you change. Preserve logs by extending retention and exporting. Image affected systems before rebuilding, or isolate them rather than wipe them. Preserve mailboxes rather than delete. Record every action with time and actor. Then contain. The workflow states this order so it is followed under pressure.
Custody and privilege
Who holds the evidence, where, with what access, documented from the moment of capture. Investigations directed by counsel can attract privilege; engaging counsel early and routing the forensic work through them is a decision the plan should already have made.
Designed before, not during
The workflow, the tooling to capture images and logs, the storage with controlled access and the roles are prepared in advance and exercised in tabletops. See evidence preservation workflows, working with legal, forensic and insurance partners and the glossary entry for evidence preservation.
By David Selakovic · Published 2026-10-16 · Revised 2026-10-16 · Reviewed every 180 days