Evidence Preservation and Chain of Custody
Learn to preserve digital evidence correctly during a security incident so it remains intact, verifiable, and admissible for investigation or legal action.
Why Evidence Handling Matters
During a breach, the instinct is to fix and move on. But if evidence is altered or lost, you cannot prove what happened, and any legal case collapses.
This lesson covers preserving evidence with a defensible chain of custody.
Order of Volatility
Some evidence vanishes faster than others. Collect the most volatile first.
- CPU registers and cache
- RAM and running processes
- Network connections
- Disk files
- Backups and logs (most durable)
All lessons in this course
- Recognizing Security Breaches and Indicators
- Basic Digital Forensic Techniques
- Containment and Eradication Strategies
- Evidence Preservation and Chain of Custody