Preserving digital evidence is the first and most critical phase of any forensic investigation. The goal is to create a perfect, verifiable copy of the original data without altering even a single bit.
Standard forensic preservation process (ISO/IEC 27037 compliant)
Physical seizure & documentation
Photograph the device/scene, record serial numbers, port status, time and persons present.Creation of a forensic (bit-for-bit) image
The entire storage medium (hard drive, SSD, phone, USB stick, cloud backup, etc.) is duplicated at the physical level using write-blockers (hardware or software).Integrity verification
Cryptographic hashes are calculated both for the original and the copy:- SHA-256 (mandatory)
- MD5 or SHA-1 (additional)
If even one hash differs → the copy is invalid.
Chain-of-custody documentation
Detailed protocol containing: who, what, when, where, which tools (with serial numbers and calibration status), hash values, storage location.Secure storage
The verified forensic image is stored on encrypted media in an access-controlled evidence room or secure cloud vault. The original device is sealed and stored separately.
Critical rule
Never power on, browse, or connect the original device to any computer before professional imaging.
Even opening a single file can overwrite deleted data and destroy its evidentiary value in court.