Preservation Checklist: Quarantine the Device, Hold the Account

Global Digital Forensics checklist. Edition 2026-11-03, November 3, 2026. 24/7 hotline (800) 868-8189.

The laptop in the drawer and the account scheduled for deletion are usually the whole record. This checklist coordinates custody of the device, protection of the account and capture of the sources that expire first, so that nothing is lost to routine offboarding before an examiner arrives.

Why the First Boot Decides What the Record Can Show

Starting or using a computer changes it. If the computer is already off, it stays off, labeled and locked away with its custody recorded. If it is running, write down what the screen shows, leave it alone and call the examiner, who decides with the technical owner whether to isolate it from the network, capture memory, keep it powered or shut it down, weighing safety, ongoing harm, encryption and what the matter needs. Every live step is recorded, and the report states the acquisition method actually used.

Microsoft 365 sources have separate lifecycles. An Exchange mailbox, a deleted user’s OneDrive and an unlicensed OneDrive account are each kept or removed under different rules, and blocking sign in, removing a license and deleting the user are four different actions. Confirm the mailbox type, license, hold and retention; the OneDrive site and its configured deleted user retention; and any unlicensed archive state. Check each lifecycle on its own. Microsoft states a new eDiscovery hold can take up to 24 hours to take effect, so plan an interim export for anything due to expire sooner.

Coordinate Device Custody, Account Protection and Expiring Sources

At receipt, record the asset tag, the custodian, the location, the power and lock state, what is connected and who handled it before. Inventory associated drives and media without plugging them into an ordinary workstation.

In parallel, the administrator confirms the account and license state and places supported preservation on the mailbox, OneDrive and related locations. Formal holds need the right license and permissions; record when each hold became active, which locations it covers and any errors. Identity, audit, endpoint, VPN and backup sources are preserved separately with their own dates and retention. Every captured file is hashed, and the queries, exports and actions are kept with it.

Who Holds the Device, Who Holds the Account and Who Waits

Counsel owns the decision to preserve and the written instruction that says so. HR or the receiving manager owns the physical device from the moment it is returned until an examiner signs for it. The Global Administrator owns the account hold and the exports, working from a written list so nothing is skipped under pressure. The backup and security teams own their own log sources. The examiner owns the acquisition. Writing those roles into the offboarding procedure, so a sensitive departure triggers quarantine and hold automatically, is the change we most often recommend to general counsel.

The people who wait are the ones who want answers fastest. The manager who wants to know what the employee took waits for the preserved copy, because signing in to the mailbox or the OneDrive gives every opened file a new access time attributed to the company, and the other side will argue tampering. The help desk leaves the laptop exactly as it arrived. The administrator saves keyword searches for the preserved export, because a search in the live mailbox is itself a recorded action. Each of those steps can be taken later from a verified image or a preserved export, under the direction of counsel.

The Routine Habits That Destroy the Record

Reimaging the laptop for the next hire, deleting the user to free the license and changing a retention policy are the three routine steps that end most matters before they start. Pause them through the owners who run them, and write down anything that already happened so the examiner can look for surviving and alternative sources. An informal copy someone made of the files is labeled as a copy and kept with its handling history.

Documentation failures are quieter but as damaging. A device that moved between three desks before reaching the cabinet, with nobody able to say who had it on which day, invites a chain of custody challenge that no later analysis can cure. A preservation instruction reaches the backup administrator, the MDM administrator and the person who runs the VPN as well as legal, so every source is held before it expires on schedule.

How GDF Supports Counsel From Quarantine to the Witness Stand

Global Digital Forensics has performed computer forensic examinations for counsel, internal auditors and corporate security teams since 1992, from sixteen US offices and a 24/7 hotline. On a preservation call we coordinate the device and account decisions with the owners, select the acquisition method for the actual system and keep the collection record and integrity checks for everything we capture. Robert Knudsen, a Certified Computer Examiner with 18 years of forensic experience, has conducted hundreds of computer and mobile device examinations supporting matters in federal and state courts. Where a careless boot has already happened, we identify the technician’s session and annotate everything it touched, so the timeline keeps the help desk’s activity apart from the custodian’s.

Counsel receives a documented acquisition protocol, a custody record, an inventory of what was collected and any gaps, and a report in which each finding traces to its artifact. A LNK file shows that a path was opened from a profile, and the report states exactly that; logon records and other corroboration are where the examiner looks for who sat at the keyboard. Our clients include AmLaw 100 firms and Fortune 1000 companies, and the initial consultation is free. If a device is in a drawer and an account is scheduled for deletion, call (800) 868-8189 before the next business day starts.

Device and Microsoft 365 decision record

For the device, record its state, the decision owner and authority, operating dependencies, whether encryption recovery is available, the method selected, the time and any change it caused. Recovery keys and passwords travel through a separate secure handoff.

Use separate rows for the Exchange mailbox hold and retention, the deleted user OneDrive retention and the unlicensed OneDrive state, and record the configuration you actually observed. Identity and audit log retention have their own rows.

The Checklist at a Glance

The same rows are in computer_forensics_preservation_checklist_workbook.csv, with columns for the owner, the date, notes, status, the evidence ID and the next action.

Sources