Digital Evidence Preservation: What to Save Before Critical Cyber Evidence Disappears

When something goes wrong online, the first instinct is often to fix it immediately.

Delete the suspicious message.

Reset the account.

Remove the malicious file.

Reinstall the application.

Restore the website.

Block the person.

Factory-reset the phone.

Close the fraudulent account.

Those actions may eventually be necessary.

But when a cyber incident, fraud, account takeover, online impersonation or digital dispute may need to be investigated, acting too quickly can unintentionally destroy valuable evidence.

Digital evidence is different from many forms of physical evidence.

A log may be overwritten automatically.

A message may be deleted.

An account may disappear.

A website may change.

A cloud provider may retain records for only a limited period.

A device reset may remove artifacts that could have helped reconstruct what happened.

That is why digital evidence preservation can be one of the most important early steps in a digital investigation.

What Is Digital Evidence?

Digital evidence is information stored, transmitted or recorded electronically that may help establish what happened during an incident.

It can exist almost anywhere.

Examples include:

• Emails
• Text messages
• Social media messages
• Photographs
• Videos
• Call records
• Login history
• IP addresses
• Server logs
• Website files
• Documents
• Account notifications
• Transaction records
• Cryptocurrency addresses
• Blockchain transactions
• Browser history
• Cloud records
• Device data
• Security alerts
• Metadata
• Database records

The value of a particular artifact depends on the investigation.

A screenshot might be useful in one case.

In another, the underlying message, its metadata and associated account records may be considerably more important.

Why Digital Evidence Can Disappear

One of the biggest challenges in digital investigations is that evidence does not necessarily remain available forever.

Logs Can Be Overwritten

Servers, websites, applications, cloud platforms and security systems generate logs.

Some retain them for months.

Others may retain them for much shorter periods.

Once the retention period expires, older records may be automatically deleted or overwritten.

Messages Can Be Deleted

An attacker, scammer or account owner may delete messages.

Platforms may also remove accounts or content for policy violations.

Websites Can Change

A fraudulent website visible today could be completely different tomorrow.

The operator might change the domain, remove pages or shut the website down entirely.

Accounts Can Disappear

Social media accounts, messaging profiles and fraudulent investment accounts can be deleted or suspended.

Devices Can Change Constantly

Phones and computers continuously create and modify data.

Installing software, deleting applications, clearing browser history, performing updates or resetting a device can alter potential evidence.

Online Services Control Their Own Records

Some important information may exist only with an email provider, social media platform, cryptocurrency exchange, hosting provider, telecommunications company or other third party.

The user may not have direct access to all of those records.

This makes early preservation especially important.

What Does It Mean to Preserve Digital Evidence?

Preservation means taking appropriate steps to protect potentially relevant information from unnecessary alteration, deletion or loss.

That does not simply mean:

Take a screenshot of everything.

Screenshots can be useful, but proper preservation may involve much more.

Depending on the incident, it can include:

• Saving original files
• Preserving emails in a format that retains relevant information
• Exporting available account activity
• Recording URLs
• Preserving logs
• Documenting timestamps
• Capturing relevant account information
• Protecting devices from unnecessary changes
• Preserving transaction records
• Maintaining copies of communications
• Documenting how evidence was collected

NIST describes digital forensics as involving the identification, collection, examination and analysis of data while preserving its integrity and maintaining an appropriate chain of custody. That is why preservation should be considered before extensive analysis or remediation whenever circumstances allow.

Screenshots Are Useful — But They Are Not Everything

Screenshots are one of the easiest ways to document something visible on a screen.

They can preserve:

• Fraudulent profiles
• Messages
• Website content
• Transaction screens
• Account changes
• Security notifications
• Threats
• Impersonation
• Advertisements
• Investment claims

But a screenshot may not preserve all of the underlying technical information.

For example, an email screenshot may show:

From: John Smith
Subject: Payment Instructions

But the original email may contain additional header information that could be relevant to an investigation.

Likewise, a screenshot of a cryptocurrency transaction may show an amount while the actual transaction hash and blockchain record provide much more useful information.

The best evidence is often the underlying digital artifact plus documentation of what was visible, rather than a screenshot alone.

Preserve Original Emails

Email can contain important technical information.

If a suspicious email is relevant to an investigation, avoid relying solely on copied text.

Where possible, preserve the original message.

Potentially useful information may include:

• Sender information
• Recipient information
• Date and time
• Subject
• Message content
• Attachments
• Links
• Email headers
• Routing information

Headers can sometimes help investigators examine how an email traveled between systems.

However, email addresses and header information should still be interpreted carefully because elements can sometimes be spoofed or manipulated.

Preserve Text Messages and Messaging-App Conversations

If an incident involves SMS, WhatsApp, Telegram, Signal, social media messages or another messaging platform, preserve the conversation as completely as reasonably possible.

Important information can include:

• Username
• Display name
• Telephone number
• Profile information
• Message timestamps
• Images
• Attachments
• Voice messages
• Links
• Payment instructions
• Cryptocurrency addresses

Context matters.

A single screenshot of one message may not explain what happened before or after it.

Where possible, preserve enough of the conversation to show the sequence of events.

Preserve Usernames and Profile Information

Online identities can change quickly.

If a suspicious person contacts you through social media, a dating application, messaging service or investment group, record relevant identifying information.

This can include:

• Username
• Profile URL
• Display name
• Profile photographs
• Bio information
• Telephone number
• Email address
• Associated websites
• Account ID where visible

A display name alone may not be particularly useful because thousands of accounts can use the same name.

A specific profile URL, username or account identifier can be much more valuable.

Preserve Website Information

If a suspicious or fraudulent website is involved, record more than just the company name.

Preserve:

• Full domain name
• Relevant URLs
• Screenshots
• Contact information
• Payment instructions
• Wallet addresses
• Email addresses
• Telephone numbers
• Usernames
• Claims made on the website
• Account dashboards
• Transaction information

Fraudulent websites can disappear quickly.

Operators may also move activity from one domain to another.

Preserving the exact domain and relevant pages can therefore become important.

Preserve Cryptocurrency Evidence

Cryptocurrency investigations can depend heavily on precise transaction information.

If cryptocurrency was sent as part of a suspected scam, preserve:

• Transaction hash
• Sending wallet address
• Receiving wallet address
• Cryptocurrency type
• Amount
• Date and time
• Exchange or wallet used
• Withdrawal records
• Deposit records
• Screenshots
• Communications surrounding the payment

The transaction hash can be especially important because it identifies a particular blockchain transaction.

Do not rely solely on:

“I sent them $20,000 in crypto.”

Investigators need the underlying transaction details.

Public blockchain data can then potentially be examined as part of a Blockchain Transaction Tracing investigation.

Preserve Account Takeover Evidence

If an online account has been accessed without permission, potentially relevant evidence may include:

• Login notifications
• Login history
• Unknown devices
• IP-related information
• Password-reset emails
• Recovery-account changes
• Authentication changes
• Forwarding rules
• Suspicious messages
• Unauthorized transactions
• Security alerts

If you need to secure the account immediately, do so through the legitimate provider.

But document suspicious information before it disappears when safely possible.

Our Account Takeover Investigation guide explains this process in greater detail.

Preserve Evidence From a Hacked Website

Website incidents can generate valuable technical evidence.

Depending on the environment, this may include:

• Server logs
• Website files
• Authentication logs
• Hosting records
• Administrator activity
• Security alerts
• Database records
• DNS information
• Suspicious scripts
• Malware
• Backups

Deleting malicious files or immediately rebuilding the server can potentially remove evidence.

Containment may still be necessary, but investigation and remediation should be coordinated when possible.

Our Hacked Website Investigation guide covers this scenario separately.

Be Careful Before Factory-Resetting a Phone

If you suspect that a phone contains evidence relevant to an investigation, think carefully before performing a factory reset.

Resetting a device can significantly change its data.

Likewise, repeatedly installing security applications, deleting applications, clearing history or extensively using the device can modify potential artifacts.

That does not mean you should leave a dangerous situation unaddressed.

Safety and security may require immediate action.

But if the device itself may need forensic examination, preservation should be considered before unnecessary changes are made.

This becomes particularly important in Mobile Phone Forensics investigations.

Preserve Financial Records

If the incident involves financial fraud, preserve records associated with the payment.

Depending on the case, these may include:

• Bank transfers
• Wire instructions
• Credit or debit card transactions
• Cryptocurrency transactions
• Payment-service records
• Receipts
• Invoices
• Account statements
• Payment confirmations
• Recipient information

Also preserve communications that explain why the payment was made.

The transaction alone may show where money went.

The communications may help establish how the victim was persuaded to send it.

Preserve the Entire Story, Not Just the Final Transaction

This is especially important in scam investigations.

Suppose someone communicates with a victim for three months before convincing them to transfer cryptocurrency.

The final payment is important evidence.

But so are the previous three months of communications.

Those messages may contain:

• Names
• Usernames
• Telephone numbers
• Email addresses
• Websites
• Investment claims
• Wallet addresses
• Instructions
• Threats
• False identities
• Other associates

Together, those artifacts can provide a much more complete investigative picture.

Keep a Timeline

A simple timeline can be extremely valuable.

Record important events such as:

January 4 — Initial contact

January 8 — Conversation moved to WhatsApp

January 15 — Investment platform introduced

January 18 — First cryptocurrency transfer

January 24 — Additional payment requested

February 2 — Withdrawal denied

February 3 — Additional “tax” demanded

February 5 — Communication stopped

A timeline helps investigators correlate communications, transactions and account activity.

Use exact dates and times where available.

Do not guess.

If you do not know an exact date, make that clear.

Do Not Edit Original Evidence

Where practical, preserve original material and work from copies.

Avoid unnecessarily:

• Editing images
• Cropping the only copy of a screenshot
• Renaming original files repeatedly
• Modifying documents
• Resaving media in different formats
• Changing timestamps
• Deleting metadata

If you need a cropped image for explanation or presentation, keep the original too.

What Is Chain of Custody?

When digital evidence may be used in litigation, insurance matters, corporate investigations or law-enforcement proceedings, documenting how evidence was handled can become particularly important.

Chain of custody refers to documentation showing how evidence was collected, transferred, stored and handled.

Depending on the circumstances, this can include:

• Who collected the evidence
• When it was collected
• Where it came from
• How it was acquired
• Where it was stored
• Who subsequently accessed it
• What analysis was performed

The requirements can vary depending on the legal context and jurisdiction.

For serious matters, appropriate legal and forensic professionals should determine the preservation procedure.

Cryptographic Hashes and Evidence Integrity

Digital forensic practitioners may use cryptographic hash values when preserving evidence.

A hash can function as a digital fingerprint of data.

If the underlying data changes, its calculated hash value will generally change as well.

Hash values can therefore help demonstrate whether a preserved digital file or forensic image has remained unchanged since acquisition.

This is considerably different from simply saying:

“I saved the file and didn’t touch it.”

Forensic procedures can provide a documented method for verifying integrity.

What Not to Do With Potential Digital Evidence

Avoid unnecessary actions that could destroy or alter relevant information.

Depending on the situation, that may mean avoiding:

• Deleting suspicious messages
• Wiping devices
• Factory-resetting phones
• Destroying original files
• Clearing browser history
• Deleting suspicious accounts before documenting them
• Editing original screenshots
• Reinstalling compromised systems without considering preservation
• Throwing away old devices
• Confronting suspects through evidence-containing accounts

Also avoid attempting to “hack back” into another person’s account or device.

An investigation should preserve and analyze evidence lawfully rather than create additional legal and technical problems.

When Should Digital Evidence Be Preserved?

Consider preservation as early as possible when an incident involves:

• Account takeover
• Email compromise
• Website hacking
• Social media hacking
• Cryptocurrency fraud
• Romance scams
• Online impersonation
• Identity misuse
• Cyber harassment
• Business email compromise
• Corporate misconduct
• Data theft
• Mobile-device concerns
• Unauthorized system access
• Financial fraud

You may ultimately decide that a full forensic investigation is unnecessary.

But evidence that was properly preserved remains available.

Evidence that was destroyed may be impossible to recreate.

How Cyb3rsect Approaches Digital Evidence Preservation

Cyb3rsect approaches preservation by first identifying which evidence may be relevant to the incident and where that information exists.

Depending on the matter, evidence may be located across:

• Computers
• Mobile devices
• Email accounts
• Websites
• Servers
• Cloud services
• Social media
• Messaging applications
• Cryptocurrency blockchains
• Financial records
• Third-party platforms

The appropriate preservation method depends on the evidence source, investigation objectives and circumstances of the case.

The goal is not simply to collect as much data as possible.

It is to identify and preserve relevant evidence in a manner that supports reliable analysis later.

Preserve First. Investigate Second.

Digital investigations are often limited by the evidence that remains available.

The best investigator cannot analyze a log that has already been overwritten.

They cannot examine an original message that was permanently deleted.

They cannot recover every artifact from a device that has been wiped.

They cannot reliably reconstruct every webpage after a fraudulent website disappears.

That is why preservation matters.

When a serious cyber incident, scam, account compromise or digital dispute occurs, consider the evidence before making unnecessary changes.

Document what happened.

Preserve original information where possible.

Record dates, accounts, transactions and communications.

And if professional forensic examination may be necessary, seek guidance early.

The evidence you preserve today may determine what can be established tomorrow.

Cyb3rsect provides digital investigation, digital forensics and evidence-preservation support for cyber incidents, account compromises, cryptocurrency investigations and other matters involving electronic evidence.