Preserving synthetic evidence

Purpose and when to use it

Begin preservation as soon as relevant evidence and lawful access are identified. Revisit the plan when new dependencies, volatile logs, or remote sources become apparent.

Evidence required

Inventory original bytes, available source metadata, acquisition notes, related manifests, and external record references. Identify retention conditions and storage constraints before relying on continued availability.

Principles and procedure

• Assign a stable evidence identifier and record the initial condition.
• Preserve an original set with appropriate access restrictions; examine documented working copies.
• Hash byte objects and verify transfers, keeping digests associated with exact filenames and sizes.
• Record transformations, storage locations, responsible handlers, and interruptions. Preserve context separately when it cannot be embedded in the object.

What to document

A preservation record should explain the retained object, storage controls, integrity checks, dependencies, and changes made during a live collection. Document the reason for each intentional transformation.

Failure modes

Silent overwriting of a working file, automatic synchronization, and conflating an exported transcript with its source can obscure the handling history. A digest without a source identifier is hard to use later.

Limits on the conclusion

Preservation cannot recreate data that was never retained. It also does not establish the accuracy of an original source; integrity and factual truth are separate concerns.

Independent checks and corroboration

Check transfer digests and compare retained originals with authorized source inventories. Use custody records to investigate discrepancies rather than treating every mismatch as misconduct.

How to report the result

Describe what was preserved, the point at which preservation began, and any earlier gap. Explain which interpretations require context that could not be retained.

Related methods

• The complete evaluation method
• Acquiring AI-related evidence
• Documenting chain of custody

Related glossary terms

• preservation
• chain of custody

What do you preserve before opening the project?

Identify relevant volatile state and sources that can change on access. Record the initial conditions, preserve authorized originals, and document protective measures. Work on identified copies and retain the actions that created unavoidable changes.

The report explains why the order of collection was chosen and which effects remain possible. Preservation reduces alteration and loss; it does not justify a claim that an active system remained perfectly unchanged.