Evidence Preservation is the set of practices used to maintain the original state, integrity, and availability of digital evidence from the moment of collection through its presentation in an investigation or court proceeding.
Explanation
Digital evidence is inherently fragile. Files can be altered by opening them, timestamps updated by simply viewing a directory, and data destroyed by rebooting a live system or writing new data to a storage device. Evidence preservation addresses this fragility by ensuring that once evidence is acquired, it is protected from intentional or accidental modification for the entire life of the case. Preservation begins the instant evidence is identified and continues until the matter is formally closed.
The cornerstone of preservation is the write blocker used during acquisition, which prevents any write operations from reaching the original media. Acquired images are then protected through cryptographic hashing (typically SHA-256) — a hash computed at acquisition is recomputed at every transfer or analysis stage, and any mismatch signals that the evidence has changed. Working copies are used for analysis while the original evidence and its verified image remain untouched.
Preservation also encompasses the documentation trail: who handled the evidence, when, where, and why. Without this, even perfectly preserved bytes may be challenged as inadmissible. Preservation therefore cannot be separated from Chain Of Custody — the two work together to make evidence trustworthy and defensible.
Examples
A forensic examiner seizing a laptop removes the hard drive, attaches it to a hardware write blocker, and images it. The image's SHA-256 hash is recorded; months later, before trial, the hash is recomputed and matches, proving the evidence is unchanged.
An investigator collecting volatile network evidence from a compromised server documents the exact commands run and their timestamps, preserving both the evidence and the record of how it was gathered, so the impact of their own activity can be accounted for.