What it means
Evidence supports or challenges a specific claim. A record becomes useful evidence when you can explain its source, context, and limits, not simply because it appears in a security console. Separate observations from interpretation: an export event may show that an account requested a file, while a download-completion event provides different support for whether data left the system. Preserve material that contradicts your preferred explanation. Good incident notes make uncertainty visible so another person can review the decision.
The idea at a glance / Evidence
Make the conclusion no bigger than the record.
The same preserved export record supports a narrow statement and leaves specific questions open.
Illustrative test on 2026-09-29, UTC. Authorized collector R1 preserves raw TestDB record E42 in case C9 at 02:06:03 and examines a working copy. Event time is 02:06:00.
READ THE PICTURE
Support the statement; retain the questions
TestDB reported a completed 200-record export under Ops for TEST-7. Preserved E42 supports that narrow statement. It does not establish the human operator, permission, or later destination; those questions need further evidence.
Keep in mindThis example preserves one record, not a complete investigation. Check source reliability, collection scope, conflicting material, and transformations. Unchanged bytes do not prove the original report was truthful.
Read the complete example
- Support the statement; retain the questions. TestDB reported a completed 200-record export under Ops for TEST-7. Preserved E42 supports that narrow statement. It does not establish the human operator, permission, or later destination; those questions need further evidence. On 2026-09-29, TestDB record E42 reports a completed export of 200 test records under account Ops for job TEST-7 at 02:06:00 UTC. Authorized collector R1 preserves the raw record, source identity, and collection time 02:06:03 UTC in case C9 and examines a working copy. E42 supports a statement about what TestDB reported. It does not establish the human operator, permission, or later destination. Additional and conflicting material may change an interpretation; an unchanged copy does not prove the record was originally truthful or the collection complete. This is one preserved record, not a full forensic acquisition or chain-of-custody demonstration.
This example preserves one record, not a complete investigation. Check source reliability, collection scope, conflicting material, and transformations. Unchanged bytes do not prove the original report was truthful.
Diagram references: NIST SP 800-86: Collection, analysis, and reporting
AN ILLUSTRATIVE SCENARIO
Investigating an unexpected patient-record export
A clinic receives an alert about a large export. The investigator preserves the application’s original export record, the relevant access logs, and the associated account history. The records show a request from an administrative account, but not whether the requester was the assigned employee. The report states that distinction. A colleague’s recollection may guide further questions, while the preserved records support the chronology.
Put it to work
- State the question the material addresses. Collect only relevant data using an authorized method, and record the source, collector, time, and collection scope.
- Protect original material from casual alteration and work on copies. Record transfers and transformations; use hashes where appropriate to check that file bytes remain unchanged.
- Connect conclusions to specific records. Document conflicting observations and gaps, and restrict distribution when evidence includes personal information or confidential business data.
How to check your work
Ask a colleague to reproduce one conclusion using the cited evidence. They should locate the original material, understand how it was obtained, and identify both what the records support and what remains unresolved.
Connect the ideas
- Provenance
The recorded origin, collection method, transformations, and completeness limits of a piece of evidence.
- Log
A record emitted by a system that something happened, which may later be used as evidence.
- Integrity
The property that data and processes remain complete and unaltered except by authorized action.
- Incident
An event or set of events that actually or potentially causes a security loss requiring coordinated handling.