Volatile evidence including memory contents, logs, and system states may be lost through remediation and normal retention cycles. Preservation must be balanced against the operational need to restore systems.
Log retention periods are frequently short.
Alternative Names:
Cyber Incident Preservation|Incident Evidence Preservation
Why it Matters?
Remediation destroys evidence, since rebuilding compromised systems eliminates the forensic artifacts establishing what occurred, which creates genuine tension between restoring operations and preserving proof and requires imaging affected systems before rebuilding. Short log retention periods, frequently thirty to ninety days, also mean the window closes quickly. Documenting preservation decisions protects against later spoliation allegations.
Frequently Confused with
Related terms
Frequently asked questions
What tension does remediation create?
How quickly does the window close?
