Progressive change is the principle that digital evidence is not static: systems, files, and data continually change through normal use, automated processes, and the passage of time, so what a system contains tomorrow is never exactly what it contained today.
Explanation
Unlike physical evidence — where a fingerprint on a doorknob may persist for years — digital evidence exists in a constant state of flux. Logs rotate and are overwritten, memory is reallocated and zeroed out, timestamps update on access, caches flush, and background services rewrite data continuously. Even the act of powering a machine on or off alters its state. Progressive change recognizes that every moment of delay between an incident and acquisition means evidence is being lost or modified, often irreversibly.
This principle drives several core forensic practices. First, it justifies live acquisition: when volatile data (RAM, network connections, running processes) would vanish on shutdown, investigators capture it before pulling the plug. Second, it demands timely response — the longer evidence sits, the more it drifts from its state at the time of the incident. Third, it reinforces the need for Evidence Preservation: once acquired, evidence must be protected from further change, because the original source can never be returned to its incident-time state.
Progressive change also shapes interpretation. An analyst must distinguish artifacts that reflect the incident from changes caused by normal operation after the fact. This is why documentation of when each acquisition step occurred is as important as what was acquired, and why Chain Of Custody records tie each artifact to a specific point in the system's evolving timeline.
Examples
- Volatile memory: A compromised server's RAM contains the malware's unpacked payload and C2 connections. Thirty minutes later, a scheduled job reuses that memory. Live capture is the only way to preserve what existed at discovery time.
- Log rotation: A system overwrites its authentication logs every 14 days. An intrusion investigated three weeks later may have no login records left, even though the attacker definitely authenticated.