Definition[]
Evidence preservation is the process of seizing suspect property without altering or changing the contents of data that resides on devices and removable media. It is the first step in digital evidence recovery.
Overview[]
Preservation involves the search, recognition, documentation, and collection of electronic-based evidence. In order to use evidence successfully, whether in a court of law or a less formal proceeding, it must be preserved. Failure to preserve evidence in its original state could jeopardize an entire investigation, potentially losing valuable information about an incident permanently.
Source[]
- NIST, Guidelines on PDA Forensics, Glossary, at 26 (NIST Special Publication 800-72) (Nov. 2004) (full-text).