CyberGuard dictionary / Incident Response
Evidence Preservation
Evidence preservation is the protection of relevant records, devices, and data from alteration or loss during a security investigation.
In simple terms
Logs can roll over and devices can change simply by staying on. Responders plan what to collect and document what happened to it.
Technical explanation
Preservation includes controlled collection, accurate timestamps, access restrictions, cryptographic hashes where appropriate, and records of each handling step. Volatile evidence may require prompt capture before shutdown or isolation.
Preservation aims to keep relevant information available and traceable for investigation. Collection order matters when memory, short-lived logs, or cloud records may disappear quickly.
Examples in practice
Before wiping an affected laptop, an investigator records its state, collects relevant logs, and stores an image with a verified hash.
Before restarting a compromised server, responders capture volatile process information and export expiring audit logs. They record collection times and limit access to the stored copies.
Why it matters
Reliable evidence supports incident reconstruction and helps others distinguish observation from assumption.
VERIFY & LEARN MORE
Sources and further reading
- csrc.nist.govhttps://csrc.nist.gov/pubs/sp/800/86/final↗
- csrc.nist.govhttps://csrc.nist.gov/pubs/sp/800/61/r3/final↗
Published 2026-10-15 · Last updated 2026-10-15 · CyberGuard editorial content. Source links provide context; they do not imply endorsement.