Digital Evidence Preservation

What it is and why it matters

Digital data is fragile in a way paper is not. A running computer rewrites logs every second. A phone receives messages, syncs with the cloud and can be wiped from anywhere. A solid-state drive erases deleted blocks on its own schedule. A cloud account keeps data only as long as a retention policy says so. Preservation is the discipline of stopping all of that at the right moment, or where it cannot be stopped, of capturing what exists before it goes.

The first decisions are made by whoever reaches the scene or the system first, often not a forensic specialist. Do you pull the plug or capture memory? Do you switch the phone off or put it in a shielded bag? Do you let the IT team "check" the server? ISO/IEC 27037:2012 describes the roles of first responder and specialist and what each should and should not do, and much of this page follows that structure.

Preservation also has a legal side. An organisation that knows a dispute is coming must stop routine deletion of relevant records, which in practice means a legal hold. Police searches under the Bharatiya Nagarik Suraksha Sanhita, 2023 must be recorded by audio-video electronic means, so the act of seizure is itself preserved. And once anything is collected, its hash is the proof that it stayed the same.

Types of digital evidence

Volatile Memory
The contents of RAM, running processes, open network connections and encryption keys, which vanish at power-off and can only be captured from a live system.
Storage Media
Hard drives, solid-state drives, USB devices and memory cards, preserved by write-blocked imaging and sealed storage of the original.
Mobile Devices
Phones and tablets, preserved by isolation from networks, control of the power state and prompt extraction before locks and remote commands change what is reachable.
Logs and Audit Trails
Server, application, firewall and cloud logs that rotate and overwrite on a schedule, preserved by export or by extending retention at once.
Cloud and SaaS Data
Mailboxes, drives, chat and tenant audit logs held by a provider, preserved by hold features, exports and preservation requests under the right authority.
Network Traffic
Packets and flow records that exist only while captured, preserved by capture at the time of the incident.
Removable and Optical Media
Pen drives, cards and discs found at a scene, which are easy to lose, swap or overwrite if not bagged and labelled immediately.
Video Surveillance Recordings
DVR and NVR storage that overwrites itself in days, preserved by export or by seizing the recorder before the loop runs.

Devices and data sources

Desktops, laptops and servers found running, asleep or off
Phones and tablets in locked, unlocked and powered-off states
External drives, pen drives and memory cards at the scene
Cloud tenants and personal cloud accounts linked to devices
Network devices, firewalls and security appliances with rotating logs
Virtual machines and hypervisor hosts, including snapshots
DVR and NVR units and their exported clips
IoT devices, vehicles and drones whose data sits in volatile buffers or small flash chips
Backup systems that hold earlier versions of data already changed on the live system

How an examination runs

The order matters. Each step protects the one after it.

01
Secure the Scene and the Systems
Stop people using the devices, record who was present and photograph screens and connections. Decide what is volatile and what can wait.
02
Decide on Live or Dead
If a system is running, consider capturing memory and checking for encryption and active remote sessions before anything is switched off. If it is off, leave it off. Write down the decision and the reason.
03
Isolate Mobile Devices
Put phones in airplane mode where accessible or in a shielded bag, note the lock state and keep power where the examination plan depends on it.
04
Issue Holds and Stop Rotation
For organisations, send legal hold notices, suspend deletion policies and extend log retention on the affected systems at once. Record each action with its time.
05
Image and Hash
Acquire storage through a write-blocker or a validated collection tool, hash the source and the image and seal the original. Where cloud data is involved, use the provider's hold or export and hash what is received.
06
Document and Record
Complete the seizure list and the custody form. Under section 105 of the Bharatiya Nagarik Suraksha Sanhita, 2023 a police search and seizure, including the seizure list and witness signatures, is recorded by audio-video electronic means and forwarded to the Magistrate without delay.
07
Store Under Control
Place originals in the evidence store and images on controlled storage, with access logged. Re-verify hashes before examination and after any move.

Tools used in this discipline

Independent profiles: what each tool does, where it stops and what you need to know before using it.

Browse the full tools directory

Terminology

Volatile Data: Information that exists only while a system is powered, such as memory contents, running processes and network connections.
Order of Volatility: The principle of capturing the most short-lived data first, from memory and network state down to storage and backups.
Write-Blocker: A hardware device or software control that allows reading a storage device while blocking every write, so the original stays unchanged.
Forensic Image: A verified copy of a storage device, usually bit-for-bit, from which all examination is done.
Legal Hold: An instruction and a technical freeze that stop the deletion of records relevant to a matter.
Faraday Bag: A shielded pouch that blocks radio signals so that a phone cannot receive a remote wipe or new data.
Preservation Request: A formal request to a service provider to keep an account's data for a period while legal process is obtained.
Retention Policy: The rule by which a system deletes old data, which must be suspended for records under hold.
Seizure Memo: The written list of items seized, with descriptions and the signatures of witnesses and the officer, now accompanied by the audio-video record required under the Bharatiya Nagarik Suraksha Sanhita, 2023.

Challenges and limits

What makes it hard

Switching off a running system can lose memory, encryption keys and open sessions that no later step can recover
Modern phones lose access to data when they power down or lock, so the time between seizure and extraction matters
Solid-state drives erase deleted data on their own, and a write-blocker cannot stop the controller's background work
Cloud data sits with providers under their retention rules and reaching it needs separate legal process
Well-meaning IT staff often examine or reboot systems before anyone thinks of evidence
Logs on security devices rotate within days or hours, and the gap is found only when it is too late
Legal hold notices are ignored or not understood, and deletion continues until someone checks

Keeping the evidence intact

Photograph and record the state of every device before touching it
Use tested write-blockers and record make, model and firmware
Hash at acquisition, record the hash and verify again before examination
Seal originals and record seal numbers at every opening
Keep a single contemporaneous log of every preservation decision with the time and the reason

Standards and legal considerations

ISO/IEC 27037:2012
The international guideline for identifying, collecting, acquiring and preserving digital evidence, with the first responder and specialist roles this page follows.
Read the guide
NIST SP 800-86
Describes data collection in incident response, including the order of volatility and the handling of live systems.
Read the guide
SWGDE Best Practices
SWGDE's Position on Timely Preservation via Digital Acquisition and its collection documents stress that acquisition should happen soon after seizure.
Read the guide
Bharatiya Nagarik Suraksha Sanhita, 2023
Sections 94, 105 and 185 cover summons for devices likely to contain digital evidence, audio-video recording of search and seizure and search by a police officer with recorded grounds.
Read the guide
Digital Evidence Lifecycle
Where preservation sits between identification and examination and what the later stages depend on.
Read the guide

In practice

A Server Still Being Used
An incident team arrives to find the finance server in daily use and the IT lead about to reboot it to "clear the problem". The responders capture memory, export the logs that rotate nightly and image the disks overnight through a write-blocker before the server goes back into service.
A Phone in a Drawer
A complainant's phone is seized and kept in a station drawer for a fortnight. By the time it reaches the laboratory it has locked, its battery is flat and an app has auto-deleted older messages. The examiner records what was lost and why, and the station changes its practice to shielded storage and early hand-over.
A Hold Nobody Read
Legal sends a hold notice for a dispute, but the mail server's ninety-day deletion keeps running. Four months later the relevant mailbox is missing a quarter of the period. The organisation can show the notice but not the technical hold, and the gap becomes an issue in the proceedings.

This page is educational material, not legal advice. Laws and standards change, commence on different dates and are interpreted differently across jurisdictions. Always read the official text linked on this page and take advice from a qualified professional for a real matter.

Learn it at DFRTI

Free pages explain. These courses teach it on real devices with a mentor.

LegalFoundation & Legal CoursesBasics of Cyber ForensicsStart here. Evidence handling, imaging, hashing, chain of custody and your first analysis.BeginnerDCFA

StorageDigital Storage ForensicsHDD ForensicsImage hard drives through a write-blocker, find hidden areas and recover deleted data.IntermediateDCFA

LegalFoundation & Legal CoursesLegal & Court ProceduresIndian law on electronic evidence: BSA Section 63, BNSS search and seizure and the IT Act.BeginnerDCFA

Standards for this area

Careers that use it

DFRTI software

Questions people ask

Should I switch off a computer I find running?

Not before deciding what volatile data it holds. If memory, open sessions or encryption keys matter, capture them first. If the system is off, leave it off. The important thing is to decide deliberately and write down the reason.

Is a screenshot enough to preserve a chat?

A screenshot shows what was on the screen and nothing about where it came from. It can be a stopgap, but the chat database or an export with its hash is what an examiner needs and what the section 63 certificate under the Bharatiya Sakshya Adhiniyam, 2023 will have to describe.

How soon must a seized phone be examined?

As soon as the plan allows. Access to data can shrink when a phone locks or powers down, and apps may delete messages on a timer. Isolate it, keep its power state as planned and get it to the examiner quickly.

Does a legal hold mean we cannot delete anything at all?

It means you cannot delete records relevant to the matter. The hold should name custodians, systems and date ranges, and the technical freeze should match it. Deleting unrelated data under normal policy is fine, but the scope must be documented.