Evidence before interpretation
Volatile evidence can include memory, active sessions, short-retention logs, cloud audit events, EDR views, network captures, and temporary access records. Less volatile artifacts can still be revised, overwritten, or exported without context. Preserve the source, time, collector, access path, and reason for collection before drawing conclusions.
Collection checklist
- Identify the source, owner, retention window, time zone, and access restrictions.
- Capture original exports where authorized, plus a readable working copy when needed.
- Record hashes where an integrity check is useful and the collection process supports it.
- Preserve related identity, endpoint, network, application, and cloud context.
- Limit access to need-to-know participants and record transfers or handoffs.
Evidence record template
Record artifact name, source system, collection time, event-time range, collector, method, hash where applicable, storage location, access limitation, and the question it supports. Screenshots are useful context but should not replace original logs or exports when those are available.
Common mistakes
Do not alter originals while annotating, lose time-zone information, rely on an unlabeled screenshot, or collect more sensitive data than the investigation needs. Hashing supports integrity checking but does not explain provenance or prove an artifact is complete.
Handoffs and retention
Tell the next reviewer what was collected, what was not collected, why, and how to locate the original. Retention, privacy, regulatory, contractual, and legal requirements vary by organization and jurisdiction; involve qualified counsel or required internal functions where appropriate. This reference is not legal advice.