Many evidence gaps begin in an ordinary business queue: a laptop replacement, an employee departure, a license cleanup or a storage migration. The person completing the ticket may have no reason to know that a device or account matters to a dispute. A preservation process has to reach those queues before the source changes.
Put a preservation check before irreversible work
Identify who can suspend routine deletion, reimaging, account reassignment and media disposal. Counsel determines preservation scope; technical owners translate it into specific sources and actions. A notice that names a person without identifying aliases, devices, shared drives and cloud accounts leaves implementation to guesswork.
For an employee departure, reconcile the HR identity with directory identifiers, issued equipment, mobile enrollment and delegated access. For a transaction or tenant migration, record which systems will be retired, which contracts will end and which administrators will lose access. A backup's existence does not establish that it contains the required period or can restore the required records.
Check the handoff, not just the ticket status
A completed collection ticket should identify the source, acquisition method, output, validation and limitations. Check that the delivered container opens and that its inventory matches the collection scope. Keep the original package separate from working copies. Hashes support later integrity checks on collected bytes; they do not establish the truth of the underlying content.
- Preserve native messages rather than relying solely on forwarded copies.
- Record device state and handling before a technical specialist changes it.
- Keep original identifiers when renaming files for review.
- Reconcile expected accounts and date ranges against delivered exports.
- Assign an owner to inaccessible, partial or failed collections.
Keep exceptions visible until they are resolved
Urgent containment, safety concerns and damaged equipment can force a departure from the preferred sequence. Record the decision, time, decision-maker and observed effect. A missing log source should remain an open limitation, not disappear from the inventory because its collection failed.
Test the process with a sample offboarding or replacement request. Can the team find the affected sources, apply the approved action and produce a readable receipt? That exercise often exposes a coordination gap that a written policy alone will not show.
See computer forensics for source examination and legal-hold technical support for implementation work. Our scoping questions explain what to settle before collection begins.
Source guidance
NIST SP 800-86 addresses forensic techniques in incident response. NIST SP 800-101 Revision 1 addresses the distinct handling and acquisition concerns of mobile devices.