Digital Evidence Preservation
Digital evidence preservation and forensic data acquisition for legal, insurance, and compliance matters.
Digital evidence can change or become unavailable during routine operations. Early preservation captures the data before it changes, protecting later review or analysis from subsequent changes to the source.
Client Authorization and Method Selection
Data365 Evidence performs preservation and forensic data acquisition only within an approved scope.
- Client authorization. The client approves the sources, scope, and expected deliverables. For cloud systems, the client approves the accounts and data scope. For drives and devices, the client approves the permitted acquisition methods.
- Technical method selection. Data365 Evidence assesses each source and selects an appropriate method from the client-approved options.
- Scope changes. Adding a source, expanding scope, or using a method outside the approved options requires written authorization.
Data365 Evidence does not make privilege determinations or disclosure decisions.
Preservation Timing
Preservation is most valuable before routine activity, remediation, or collection alters the source.
- Changing or short-lived data. Synchronization, retention limits, automated deletion, account changes, and account access can alter timestamps, stored data, or system state.
- Remediation or device changes. Updates, resets, repairs, returns, replacements, and account-recovery steps can modify logs, artifacts, and the source.
- Informal collection. Screenshots, forwarded messages, manual copying, and selective exports often omit metadata, original headers, and system context.
- Preservation before analysis. The decision to undertake substantive forensic analysis can follow preservation.
Preservation and substantive forensic analysis are separate functions.
Digital Evidence Sources
- Devices and media
- Cloud-hosted data
- System, access, and application records
- Public website content
Preservation Controls
- Original sources are handled only as necessary.
- Integrity verification results are recorded for preserved images and exports.
- Chain-of-custody records are maintained through final delivery or return.
Matter Records
Handling records document authorization, source condition, preservation or acquisition activity, integrity verification, custody, and transfer.
- Intake and scope record
- Preservation or acquisition record
- Chain-of-custody record
- Integrity verification record
Preservation Planning Resources
After Preservation
Data365 delivers preserved data and matter records to the recipient designated by the client.