Preservation bias is the tendency for some materials, records, or evidence to survive better than others. What remains is not always a fair sample of what originally existed; it is shaped by durability, environment, handling, and time. In archaeology, that can mean stone survives while wood decays. In digital investigations, the same idea applies to logs, memory, backups, and disk artifacts: some traces persist, while others vanish quickly.
In cyber security, preservation bias matters because it can distort conclusions. Attackers may delete logs, wipe temporary files, or use volatile, in-memory techniques that leave little behind. Defenders then reconstruct events from whatever survived, such as authentication logs, endpoint telemetry, or network metadata. That surviving data can be highly valuable, but it may overrepresent certain actions and miss others entirely. Understanding preservation bias helps analysts avoid overconfidence, compare evidence sources, and treat absence of evidence as a data problem, not proof that nothing happened.