How to Preserve Evidence After a Breach or Suspicious Incident

The first rule: stop, don't fix

When you discover suspicious activity, the natural instinct is to clean up - delete the file, reinstall the machine, reset everything. Resist it. Every 'fix' can destroy the evidence that explains what happened, who did it, and what they accessed.

The immediate moves that protect your options: disconnect affected systems from the network (without powering them off), note the time and what you observed, and stop anyone else touching them.

Preserve the digital artifacts

Investigators need the machine's own records: event logs, emails, browser history, recently modified files, login records and cloud audit trails. Where possible, a forensic image of affected drives should be taken before anything is analysed - working from copies, never the originals.

For cloud services (Microsoft 365 included), preserve audit logs and mailbox data by pausing retention-affecting actions and exporting what you need while it still exists.

Document everything as you go

Write down what you know and when you knew it: who found the issue, what they saw, what actions were taken and by whom. A contemporaneous timeline is far more credible than a reconstruction written a month later - and it's what insurers and regulators expect.

Mind the chain of custody

If the matter might reach court, an insurance claim or a regulator, every piece of evidence needs a documented trail: who collected it, when, from where, and who handled it since. This is where working with professionals pays for itself.