Evidence preservation is the process of protecting items that may be relevant to an investigation — physical objects, documents, recordings and digital data — from loss, damage, contamination or alteration. The goal is straightforward: evidence must remain in substantially the same condition from the moment it is identified until it is examined, and ideally until it is presented in court, a disciplinary hearing or an insurance claim.
Evidence is fragile. A footprint washed away by rain, CCTV footage recorded over within days, a phone that keeps overwriting deleted messages while it remains in use — once lost or altered, evidence often cannot be recovered. In criminal matters, civil disputes, fraud investigations and workplace proceedings, the strength of a case frequently depends on what was preserved, how well, and by whom.
Why Evidence Preservation Matters
Courts, insurers and opposing parties all test the integrity of evidence. If there are gaps in how an item was handled, its reliability can be challenged and, in some cases, it may be ruled inadmissible. Proper preservation protects the evidence itself and the credibility of everyone who handled it. It also keeps options open: well-preserved evidence can be re-examined later by other experts, which is particularly important in criminal defence and complex commercial disputes.
Types of Evidence That May Need Preservation
- Physical items such as documents, clothing, tools and other objects
- Photographs and video, including CCTV, dashcam and doorbell footage
- Digital devices: phones, computers, tablets, servers and USB storage
- Electronic records: emails, messages, call logs, financial data and access logs
- Social media profiles, posts and private messages
- Early witness statements recorded while recollections are fresh
How Evidence Is Commonly Lost or Contaminated
Evidence is usually compromised in ordinary ways, often without anyone realising:
- Continued use of a device, which can overwrite recoverable data
- CCTV systems that overwrite footage on short retention cycles
- Well-meaning attempts to tidy, clean up or reorganise a scene or workspace
- Power surges, water, heat and physical damage to devices
- Software updates, factory resets and failed do-it-yourself recovery attempts
- Many people handling an item with no record of who did what
What a Professional Evidence Preservation Process Involves
A professional investigator or digital forensics specialist follows a documented, repeatable process. While details vary from matter to matter, the work typically includes the following.
Securing and Documenting
The scene, device or records are secured first. The specialist documents what was found, where it was found and in what condition, usually with photographs, notes and an exhibit register.
Preserving Digital Evidence
For digital material, preservation usually means creating a forensic image — a verified, bit-for-bit copy of the storage — and working only on the copy, never the original. Write-blocking tools and cryptographic hashing help demonstrate that the evidence was not altered.
Maintaining Chain of Custody
Every item is logged: who collected it, when, where it has been stored and who handled it. This chain of custody record supports the admissibility of the evidence later. In South Africa, preservation and examination must also respect the Protection of Personal Information Act (POPIA) and relevant evidence laws, and where SAPS is involved, exhibits are handed over with a proper register.
Practical First Steps You Can Take
- Stop using the device or area concerned
- Do not delete, move, repair or clean anything
- Note the date, time and who has had access
- Photograph or write down what you observed while your memory is fresh
- Secure CCTV footage early — request a copy before it is overwritten
- Contact a qualified investigator or digital forensics professional promptly
Evidence preservation rewards speed and care. Whether the matter involves suspected fraud, a commercial dispute, a workplace incident or a criminal allegation, the earlier evidence is properly secured, the more options remain available. For more plain-language guides on investigations and digital forensics, return to the Knowledge Centre.