Computer Forensics Lab
Computer Forensics Lab
Digital forensics · Since 2007
← Blog·Guides·30/01/2026

Data preservation in 2026: what has changed, and what has not.

Data preservation practice.

The core duty has not changed. If proceedings are in reasonable contemplation, relevant material must be preserved. What has changed is where the material now lives: across cloud tenants, personal devices, messaging platforms and third party services that most organisations do not fully map.

A workable preservation programme

  • A written litigation hold that names the accounts, devices and services in scope.
  • Suspension of auto deletion, retention and disappearing message settings on relevant accounts.
  • Forensic images of key devices, taken early, kept sealed and hashed.
  • A short custody note kept from the moment each item comes into the party's control.

What the courts are increasingly asking

Not just what was preserved, but when the duty arose, what was done in response, and why anything relevant was not preserved. A short paper trail, made contemporaneously, is a great deal more useful than a long explanation after the fact.