Preserve Digital Evidence

Act carefully. Ordinary use, synchronisation, deletion, resetting or software installation can alter or destroy evidence.

General precautions

• Do not delete, edit, forward or rename potentially relevant files or messages.
• Do not factory-reset, reinstall, update or “clean” a device.
• Do not use recovery software or run antivirus scans before obtaining advice where evidential integrity matters.
• Record who has handled the device or data, when, and for what purpose.
• Keep original media and devices secure and separate from working copies.

Phones and mobile devices

Do not continue browsing messages or applications unnecessarily. Keep the device charged where loss of power may cause encryption or access difficulties, but obtain case-specific advice before changing connectivity, power state or lock status.

Computers and servers

Do not shut down, restart or disconnect a live system without advice where volatile information, encryption or an active incident may be involved. In other circumstances, leaving a compromised system online may create additional risk. The correct action depends on the facts.

CCTV and video

Export footage promptly using the native system where possible. Preserve the original recording system, document the date and time settings, and avoid converting or editing the only copy.

Email and cloud evidence

Preserve messages in their native format with full headers and attachments. Screenshots alone may omit important metadata. Avoid forwarding the only copy where authenticity may later be disputed.

Request guidance

Contact Lotie at +27 82 852 8689 or lotie@digitaldetective.co.za. Explain the device type, whether it is powered on, whether it is locked, and the urgency of the matter.