Record preservation is the practice of keeping logs, chat records, files, and metadata intact and available for later review. In cyber security, preserved records help investigators reconstruct what happened, correlate events across systems, and confirm whether an alert, account action, or message is genuine. Without reliable records, incident response can become guesswork, and evidence may be weak in internal investigations or legal proceedings.
Defenders preserve records with retention policies, write-once storage, backups, access controls, and hash verification to detect tampering. Attackers often try to defeat this by clearing logs, disabling auditing, deleting messages, or destroying files after intrusion or abuse. Strong record preservation makes those efforts harder and helps expose patterns of access, persistence, and misuse.