Security · Incident Readiness · 05
Evidence preservation workflows
Evidence preservation workflows ensure that when an incident occurs, the logs, images, messages and records needed for investigation, insurance claims, regulatory response and possible litigation are captured, protected and documented before they are overwritten, altered or lost. It is needed when log retention is short, when systems would normally be rebuilt immediately after an incident, when an insurer or counsel will need forensic evidence, or when a previous incident ended with questions that could not be answered because the evidence was gone. The workflows produce defined preservation steps per system type, the tooling and storage to capture and hold evidence with integrity, the chain-of-custody records that make it usable, and the training so the first responder preserves rather than destroys.
Scope
What the review covers.
- What to preserve by system type: endpoints, servers, cloud, identity, email, network
- Capture methods and tooling for images, logs and volatile data
- Secure evidence storage with integrity verification
- Chain-of-custody documentation
- Coordination with forensic partners and counsel
- First responder guidance and training
Deliverables
What you receive.
| Deliverable | Form |
|---|---|
| Preservation playbook | Steps per system type, in order |
| Tooling and storage specification | What captures and holds evidence |
| Chain-of-custody templates | Records that keep evidence usable |
| Responder guide | One page: what to do and what not to do first |
Prerequisites
What we need from you.
- The incident response plan and the forensic partner or retained firm, if any
- Log retention settings across systems
- Counsel’s requirements for evidence handling
Related
Where this sits.
- Incident Readiness Service
- Security Hub
- Backup recovery drills Also
- Executive incident briefing templates Also
By David Selakovic · Published 2026-10-16 · Revised 2026-10-16 · Reviewed every 180 days
Questions
Asked before engaging.
Does rebuilding a server destroy evidence?
Usually, yes. The playbook defines what to capture before any rebuild, and the responder guide makes that the first step.
Do you perform forensics?
We preserve evidence and coordinate with forensic partners. Deep forensic analysis is performed by specialists we work alongside.
How long should evidence be kept?
As long as counsel and the insurer require, which is usually well beyond the incident. The storage design accounts for that.