Preservation order
Definition
A legal instrument directing a service provider to retain specific data for a defined period pending receipt of a production order or MLAT request. Under the Budapest Convention, Article 16 requires signatory states to enable rapid preservation orders for up to 90 days. Preservation is distinct from disclosure: the provider holds the data but does not yet hand it over.
Related terms
- Chain of custody
- The documented chronological record of who collected, handled, transferred, and examined a piece of evidence. For digital evidence, chain of custody includes...
- CLOUD Act
- The Clarifying Lawful Overseas Use of Data Act (US, 2018). Clarifies that US service providers must comply with valid US legal process...
- Dual criminality
- The requirement in most MLAT regimes that the conduct under investigation constitutes a crime in both the requesting and the requested state....
- European Production Order (EPO)
- A court order issued by a judicial authority in one EU member state, under Regulation (EU) 2023/1543, compelling a service provider in...
- Live acquisition
- Forensic data collection performed on a running, powered-on system. Captures volatile data and allows imaging of encrypted volumes while decryption keys are...
- Mutual Legal Assistance Treaty (MLAT)
- A bilateral or multilateral treaty under which signatory states agree to assist each other in gathering evidence for criminal investigations. MLATs define...
- Triage
- The structured process of evaluating an alert to determine whether it is a genuine security incident and, if so, what severity level...
- Volatile data
- Any digital information that is lost when power is removed or the system state changes. Examples include RAM contents, CPU register values,...
- Write blocker
- A hardware or software device interposed between a digital storage medium and the forensic workstation that prevents any write commands from reaching...
Explained in these topics
- Intake, Scoping and Evidence PreservationA formal legal notice served on a third party such as an ISP or cloud provider requiring them to retain specific data that would otherwise be deleted. Preserva...
- Legal and Jurisdictional Frameworks for Mobile and Network EvidenceA legal instrument directing a service provider to retain specific data for a defined period pending receipt of a production order or MLAT request. Under the B...