Preserve First: The 72 Hours That Decide a Digital Evidence Matter

By Alan Jeffries, Principal Consultant, D3Forensics Limited

By the time most clients call, someone has already looked. A manager scrolled the phone. IT logged into the laptop to check. The mailbox was exported by hand. Each act felt sensible, and each one wrote over part of the record it meant to protect.

What decays, and how fast

Digital evidence has half-lives. Cloud audit logs age out on fixed schedules, some in weeks. Phones overwrite deleted content in the ordinary course of being used. Laptops that keep running keep churning their own journals, shadow copies and unallocated space. A device left in a drawer holds its state; a device left in use erodes it hourly.

The looking problem

The instinct to check is the enemy. Booting a computer alters hundreds of timestamps before the desktop even appears. Opening files updates the very access records that would have proven who touched them last. Scrolling a phone can trigger synchronisation that pulls remote changes over local truth. None of it is malicious, and all of it gives opposing counsel the same gift: an interval where the evidence was in the client's hands and changing.

What to do instead

Isolate the device without operating it: power matters less than non-use. Suspend deletion and retention policies on the relevant accounts. Note who has had access, and when, in writing. Then take advice before anything else, because the next step, verified imaging, converts a fragile situation into a stable one. Once a hash-fixed copy exists, the pressure is off: analysis can proceed at the pace of thought rather than the pace of decay.

The pattern in our casework is blunt. Matters preserved in the first three days rarely lose evidence that mattered. Matters that arrive after a fortnight of internal investigation usually have a hole exactly where the answer used to be.