Digital Evidence Preservation After a Cybersecurity Incident: A Checklist
Preserve logs, messages, files, and timelines after a suspected cyber incident while maintaining evidence integrity and privacy.
Stabilize and record
Record when the incident was noticed, affected systems, symptoms, and actions already taken. Preserve timestamps and time zones; do not delay urgent containment solely to collect evidence.
Identify evidence sources
Relevant sources may include identity logs, endpoint alerts, cloud audit events, email headers, firewall records, and application logs. Prioritize retention-limited sources and avoid unrelated collection.
Maintain integrity
Keep originals where feasible, work from copies, record who collected each item and when, and use hashes to detect later changes. Store evidence securely and document transfers.
Build a timeline
Correlate identity, endpoint, network, and application events. Preserve original timestamps and distinguish confirmed facts from hypotheses or gaps.
Document limits
Record methods, scope, tools, limitations, and changes made during response. In serious matters, coordinate with qualified forensic specialists and legal advisers; do not promise guaranteed attribution or recovery.