The IT Law Wiki

Evidence preservation

32,080pages on
this wiki
Add New Page
Add New Page Talk0

Definition Edit

Evidence preservation is the process of seizing suspect property without altering or changing the contents of data that resides on devices and removable media. It is the first step in digital evidence recovery.

Overview Edit

Preservation involves the search, recognition, documentation, and collection of electronic-based evidence. In order to use evidence successfully, whether in a court of law or a less formal proceeding, it must be preserved. Failure to preserve evidence in its original state could jeopardize an entire investigation, potentially losing valuable information about an incident permanently.

Source Edit

Also on Fandom

Random Wiki