Overview
Preservation is often the first technical step when digital information may become important. BlueTrace helps identify relevant sources, document evidence intake, perform appropriate acquisition, and retain records that support the integrity and handling history of collected data.
Common reasons clients request this service
- A dispute or investigation may involve digital information
- An employee is departing and company devices need to be preserved
- A device will soon be replaced, returned, or repaired
- Relevant cloud, email, or local data may be deleted by retention or normal use
- Counsel needs a documented preservation process
What the engagement can include
◫
Evidence Intake
Identify and document devices, accounts, media, and relevant custodians.
◇
Acquisition
Perform appropriate collection or imaging based on the source and scope.
▤
Documentation
Maintain acquisition notes, hashes where applicable, and chain-of-custody records.
The appropriate forensic method depends on the device, account, legal authority, technical condition, and objectives of the matter. Scope is confirmed before work begins.