Define the questions before collecting everything
Start with the decisions the investigation must support. Which accounts or systems were accessed? What changed? Is there evidence that information was taken? Which services can return safely? Assign a collection owner and identify the systems most likely to answer those questions. Broad collection without a purpose can consume the response window and create unnecessary exposure of confidential material.
NIST’s forensic guidance treats collection, examination, analysis and reporting as distinct activities. It also recommends involving management and legal advisers when defining forensic policy. Agree authority and scope before accessing employee devices, personal accounts or third-party systems. Ownership of a business problem does not automatically confer authority to collect every potentially relevant record. [1]
Write down the initial hypothesis and what would challenge it. If the concern is a stolen cloud account, concentrating only on the employee’s laptop may leave the central question unanswered. The preservation plan should follow the likely activity across systems, then change as evidence develops.
Contain the incident while protecting volatile evidence
Avoid reflexively rebooting, wiping or rebuilding affected devices. Running memory and short-lived logs may disappear, and routine activity can change the scene. This is not a reason to leave active damage unchecked. CISA recommends isolating affected systems and preserving volatile or short-retention evidence. In its ransomware guidance, powering down is a fallback when network isolation is not possible, with the loss of memory evidence explicitly acknowledged. [3]
Ask a qualified responder to decide whether live capture is appropriate and safe. Memory acquisition and live examination change a running system; they require suitable tools, authority and documentation. Capture should not delay urgent safety measures or containment of ongoing destructive activity. Record why a particular trade-off was necessary.
Give operational teams a clear instruction: obtain incident approval before destructive recovery actions on identified systems. If an emergency requires immediate action, record what was changed, by whom and when. A documented compromise is more useful than a misleading claim that the original state was perfectly preserved.
Preserve cloud and identity records early
Cloud evidence needs its own collection list. Identify relevant identity sign-ins, administrator actions, mailbox activity, application access, file-sharing events and provider alerts. Record the tenant or account, source service, time window, filters and export method. Preserve original exports before building a spreadsheet that combines or reformats them.
Do not assume every service retains the same records for the same period. Microsoft’s Purview documentation makes audit retention dependent on the record type, licensing and applicable policies. It also explains that changes do not update previously committed audit items. An upgrade or a new policy should not be represented as a way to recover evidence that has already expired. [4]
Ask the provider or administrator to confirm the earliest available event, any export limits and missing sources. A disk snapshot can preserve useful storage state, but it does not automatically include every cloud control-plane event or application log. List what each acquisition contains, and what still requires separate collection.
Keep originals, working copies and integrity records distinct
Preserve the acquired material as the master copy and perform analysis on controlled working copies. Where appropriate, record cryptographic hashes at collection and verify them after transfer. NIST IR 8387 recommends protecting both evidence files and their integrity records, including keeping hash records secure from alteration. Use an approved modern algorithm and record which one was used. [2]
A matching hash shows that the compared bytes match. It does not prove that a file was truthful, that an export included every relevant event, or that collection was authorised. Those questions require provenance, collection notes and corroboration. Screenshots can help explain what someone saw, but they should supplement available original records rather than silently replace them.
Restrict access to the evidence repository, log handling and protect stored copies against accidental alteration or loss. Keep a separate recovery copy where appropriate. NIST’s preservation guidance emphasises secure storage and integrity; the evidence collection should not become another uncontrolled shared folder. [2]
Maintain a usable chain of custody
Chain of custody documents who handled evidence and why throughout collection, safeguarding and analysis. NIST’s definition includes the people involved, the time of collection or transfer and its purpose. This applies to a cloud export as well as a physical device. [5]
Give every item a stable identifier. Record its source, collector, collection time and time zone, method, storage location and any integrity value. For a transfer, record the sender, recipient, time and purpose. If an analyst creates a filtered extract or converted file, identify the parent item and the transformation rather than allowing the derivative to appear to be the original.
Make the record usable by someone outside the response room. A filename such as “final-logs-new” explains little. An evidence register should let another authorised reviewer locate the material and understand its history without relying on the collector’s memory.
Report what the evidence can and cannot establish
Build the incident timeline with explicit attention to time zones and inconsistent clocks. Preserve original timestamps and document any normalisation used for comparison. NIST warns that timing discrepancies across systems complicate analysis; a neat timeline is not necessarily an accurate one. [1]
Distinguish an observed event from its interpretation. A successful sign-in establishes something different from proof that a particular document was read. Missing logs may reflect retention, configuration or collection gaps. State those limitations rather than turning the absence of a record into certainty that an action did not occur.
Before handing the investigation over, confirm that the evidence register, originals, working copies and collection notes are available to the authorised team. Agree retention and eventual disposal with the relevant business and legal owners. Good preservation gives later decisions a defensible foundation; it cannot promise a particular legal outcome or reconstruct information that was never captured.
