Investigation note / 12.06.2026
Preserving digital evidence before the legal route is chosen
What to hold, what not to alter, and why early method matters more than early accusation.
Summary
The first hours of a digital matter are usually spent deciding what not to do. Deletion, ‘helpful’ forwarding and informal exports all change the file.
Context
Phones, cloud accounts and exchange logins are easy to alter and hard to reconstruct. A later court will ask how the material was obtained.
Method
Hold the original source. Record who accessed it and when. Export in a way that preserves metadata where that is possible. Do not draft a narrative on top of the export until the export is stable.
Legal options
Preservation sits before strategy. Once the file is stable, the legal options become visible: report, disclose, defend, or take no public step.
Limitations
Some sources cannot be preserved perfectly. We say so. A partial file is still more useful than a reconstructed story.
Disclaimer
This note is general information about method. It is not advice on a specific matter and it does not describe a client result.