Preservation of evidence is the practice of keeping logs, disk images, memory data, files, alerts, and other artifacts intact so they can be examined later. In cyber security, this means avoiding actions that overwrite, delete, or change material that may explain how an intrusion happened, what was accessed, and whether data was stolen.
This matters because ransomware, phishing, insider abuse, and malware incidents often leave only partial traces. Good evidence preservation supports forensic analysis, incident response, legal review, and recovery decisions. Defenders typically isolate affected systems, collect copies of relevant logs, record timestamps, and maintain chain of custody before making major changes. Attackers may try to erase or tamper with evidence by clearing logs, wiping tools, or using temporary files, which makes early preservation especially important.