Preservation planning
Digital Evidence Preservation in Legal and Insurance Matters
In legal, insurance, and compliance matters, timing and source condition affect what remains available. Authorization determines whether preservation may proceed. Access conditions determine how it can be carried out.
The scenarios below show how routine business activity—such as device turnover, access changes, and account administration—can change a source before preservation begins.
Preservation Timing Constraints
- Scheduled device replacement, reassignment, return, or wiping that limits source availability.
- Mailbox deprovisioning, account migration, or permission changes.
- Travel, shipping, or transfer schedules that limit access to the source.
- Continued business use that limits device or system availability.
- Temporary portal access, expiring download links, or provider retention limits.
Account and Device Preservation
Preserving Mailboxes and Cloud Accounts Before Access Changes
Deprovisioning, reassignment, permission changes, or migration can change what remains accessible for preservation.
Access Authorization and Scope
- Written authorization to access the mailbox or account and preserve or export data within scope.
- Custodians, folders, date ranges, shared repositories, cloud storage, and administrative exports included or excluded from scope.
- Access limitations and scheduled changes that may affect availability.
Preservation Deliverables
- Preservation documentation identifying the source, approved scope, and any exclusions.
- An export record for any data exported, including applicable verification results.
- A delivery record identifying what was provided, the recipient, and the delivery date.
Preserving Devices Before Reassignment, Return, or Wipe
- A scheduled return, replacement, or reassignment can make the device unavailable before preservation.
- Remote wiping can delete data or otherwise change the source condition before preservation.
Authorization, Availability and Scope
- Written authorization to access and preserve the device.
- Any requirement for continued business use during preservation.
- Any scheduled replacement, reassignment, return, or wipe and the resulting acquisition deadline.
- Device backups, synchronized accounts, and removable media included or excluded from scope.
Preservation Deliverables
- A record identifying the device or media and, when applicable, the account, backup, or system from which data was acquired.
- Custody records documenting receipt, transfer, and return of the device or media.
- An acquisition record identifying the data acquired, the method used, and the hash values recorded to verify its integrity.
Preservation During Ongoing Business Use
Preservation may need to proceed while a device, account, or system remains in active use.
Acquisition Scope and Timing
- The custodians, sources, date ranges, and data types included in the acquisition.
- Which sources must remain operational and when data may be acquired from each.