Digital Evidence Preservation

Client Authorization and Method Selection

Data365 Evidence performs preservation and forensic data acquisition only within an approved scope.

• Client authorization. The client approves the sources, scope, permitted methods, and expected deliverables. Cloud matters also require approval of the accounts and data scope; drive and device matters also require approval of the acquisition level.
• Technical method selection. Data365 Evidence assesses each source and selects the technical method within the approved scope.
• Scope changes. Adding a source, expanding scope, or changing an approved method or acquisition level requires written authorization.

Data365 Evidence does not make privilege determinations or disclosure decisions.

Preservation Timing

Preservation is most valuable before routine activity, remediation, or collection alters the source.

In litigation-related matters, source loss or alteration can raise spoliation concerns.

• Changing or short-lived data. Synchronization, retention limits, automated deletion, and account activity can alter timestamps, stored data, or system state.
• Remediation or device changes. Updates, resets, repairs, replacements, and account-recovery steps can modify logs, artifacts, and the source.
• Informal collection. Screenshots, forwarded messages, manual copying, and selective exports often omit metadata, original headers, and system context.
• Preservation before analysis. The client can decide on substantive forensic analysis later.