Preserving Digital Evidence in Matters Involving Account Compromise, Synthetic Media, or Suspected Record Manipulation

Data365 preserves source condition, account-access records, transfer records, and related context. It does not determine what happened, authenticate content, or reach legal conclusions.

When to Consider Preservation

Preservation is especially relevant when a matter involves account compromise, suspected synthetic media, impersonation-related records, altered screenshots or exports, or fraud-related digital records and later review depends on source condition and handling history.

Potential sources include account portals, messages, cloud repositories, device records, exported files, screenshots, access logs, transfer records, and verification references. Data365 limits handling to the approved scope.

What Preservation Can Document

Preservation and acquisition records can document source condition, account-access records, export path, file metadata, device state, log availability, storage location, and transfer path. These records show later reviewers what was available, where it came from, and how it moved through the matter.

Data365 keeps preservation separate from analysis. Intake, acquisition, and transfer remain within the approved scope; interpretation requires separate authorization.

Service Boundaries

Data365’s preservation services do not include cyber-response, fraud determinations, synthetic-media authentication, legal conclusions, or expert opinions. Data365 does not determine whether fraud occurred, whether media is synthetic, or whether a record is authentic.

Later interpretation or expert analysis requires a separate written scope. Testimony concerning Data365’s preservation or acquisition activities and related records is outside standard services and requires separate scope, scheduling, and fees, subject to availability.

Initial Intake

Initial intake identifies the records at issue, access conditions, transfer requirements, and the scope of preservation or acquisition.