EVIDENCE PRESERVATION: RECORD WHAT HAPPENED BEFORE YOU DELETE IT
Useful records can help you understand an incident, communicate with a provider and support an investigation. Evidence should be preserved carefully without putting yourself at additional risk.
THE CORE PRINCIPLE
PRESERVE USEFUL INFORMATION BEFORE CLEANING UP AN INCIDENT.
01 · RECORD THE TIMELINE
Write down when you noticed the problem, what happened first and what actions followed.
02 · SAVE RELEVANT ALERTS
Keep appropriate login alerts, transaction references, emails, messages and screenshots that help establish what happened.
03 · DO NOT ALTER MORE THAN NECESSARY
Avoid deleting messages, wiping devices or changing evidence unnecessarily before recording useful information, unless immediate safety or containment requires it.
04 · PROTECT THE RECORDS
Store relevant records somewhere appropriate and restrict access to sensitive information.
05 · AVOID SHARING SECRETS
Preserving evidence does not mean publishing passwords, recovery phrases, PINs or one-time codes. Sensitive secrets should remain protected.
06 · PROVIDE INFORMATION THROUGH TRUSTED CHANNELS
If a provider, investigator or authority needs information, use its legitimate established process.
EXAMPLE
After an account compromise, you see several unfamiliar login alerts. Before deleting them, record the dates, devices and locations shown and preserve the relevant messages. Then proceed with account recovery through the official service.
WHY THIS MATTERS
A clean-up action can sometimes remove information that would have helped establish what happened. Preserve first where practical, while still containing active threats.