Identify and record
Record the incident identifier, evidence identifier, source system, asset owner and collector.
Record the collection time, source time zone and any known clock differences.
Describe what the item is and why it is relevant without altering the original.
Preserve integrity
Prefer original or authoritative exports and preserve source metadata.
Use hashes or other integrity records where appropriate and supported.
Avoid opening, modifying, converting or forwarding evidence in ways that overwrite metadata unless a working copy is deliberately created.
Maintain custody and access
Record who collected, transferred, reviewed or exported evidence and when.
Restrict access to people with an incident or investigative need.
Keep original evidence separate from analyst working copies where appropriate.
Prioritise volatile and time-limited sources
Identify volatile memory, live sessions, temporary logs, short-retention telemetry and ephemeral cloud resources.
Preserve time-limited evidence before routine retention, reboot, scaling or cleanup removes it where feasible.
Coordinate live-system collection with qualified responders to avoid operational harm.
Collect relevant security context
Preserve identity, endpoint, network, cloud, application, email, WAF, database and security-control logs relevant to the incident.
Preserve configuration, deployment, IAM, mailbox, key, token or rule changes associated with the timeline.
Preserve alerts, threat intelligence, screenshots, communications and response decisions that explain why actions were taken.
Escalate appropriately
Seek legal or forensic guidance before collecting evidence for litigation, employment action, regulator response or law-enforcement referral.
Follow contractual, privacy, data-residency and regulator requirements that apply to the evidence.
Do not claim legal admissibility solely because a hash or custody record exists.
Boundary
This checklist supports operational evidence discipline. It does not establish legal admissibility, forensic sufficiency or compliance with any specific jurisdiction. Qualified legal and forensic advice may be required.