Glossary: Security Operations and Incident Response

Preservation

Also written: preserve

Protecting evidence from being changed or lost, using hashes, write blockers, the order of volatility and legal holds, and by leaving machines powered on.