Preserved logs are security records kept in a reliable, tamper-resistant state so investigators can later determine what happened, when it happened, and which systems or accounts were involved. They often include authentication events, process activity, network connections, file access, and admin actions.
They matter because attackers may delete, alter, or overwrite logs to hide intrusion, privilege escalation, lateral movement, or data theft. Good log preservation means collecting records quickly, storing them centrally, syncing time sources, and restricting access so the evidence remains trustworthy. In real defenses, preserved logs help confirm or reject a ransomware claim, reconstruct an attack path, support incident response, and provide material for legal or compliance review.