Preservation Order
Definition
A legal instrument directing a service provider to retain specific data for a defined period pending receipt of a production order or MLAT request. Under the Budapest Convention, Article 16 requires signatory states to enable rapid preservation orders for up to 90 days. Preservation is distinct from disclosure: the provider holds the data but does not yet hand it over.
- Function
- Direct a provider to retain specific data
- Distinct from
- A disclosure or production order
- Framework
- Budapest Convention, Article 16
- Standard duration
- Up to 90 days under Article 16
- Typical use
- Buys time to obtain a production order or MLAT request
Common questions
Why would investigators seek a preservation order instead of going straight for the data?+
Obtaining a full production order or completing a mutual legal assistance request can take weeks, during which volatile data like connection logs may be routinely deleted, so a preservation order locks the data in place at the provider without requiring the provider to hand anything over yet.
What happens if a production order or MLAT request never follows a preservation order?+
The preserved data is typically only held for the defined retention window, commonly up to 90 days, and the provider may then delete it under normal retention policy unless a valid legal process for disclosure arrives before that window closes.
Is a preservation order the same across every country?+
The mechanism and time limits vary by jurisdiction and by whether the country has implemented the Budapest Convention or an equivalent domestic statute, so investigators working across borders need to confirm the specific rules of the provider's home jurisdiction.
Related terms
- Chain of Custody
- The documented chronological record of who collected, handled, transferred, and examined a piece of evidence. For digital evidence, chain of custody includes...
- CLOUD Act
- The Clarifying Lawful Overseas Use of Data Act (US, 2018). Clarifies that US service providers must comply with valid US legal process...
- Dual Criminality
- The requirement in most MLAT regimes that the conduct under investigation constitutes a crime in both the requesting and the requested state....
- European Production Order (EPO)
- A court order issued by a judicial authority in one EU member state, under Regulation (EU) 2023/1543, compelling a service provider in...
- Live Acquisition
- Forensic data collection performed on a running, powered-on system. Captures volatile data and allows imaging of encrypted volumes while decryption keys are...
- Mutual Legal Assistance Treaty (MLAT)
- A bilateral or multilateral treaty under which signatory states agree to assist each other in gathering evidence for criminal investigations. MLATs define...
- Triage
- The structured process of evaluating an alert to determine whether it is a genuine security incident and, if so, what severity level...
- Volatile Data
- Any digital information that is lost when power is removed or the system state changes. Examples include RAM contents, CPU register values,...
- Write Blocker
- A hardware or software device interposed between a digital storage medium and the forensic workstation that prevents any write commands from reaching...
Explained in these topics
- Intake, Scoping and Evidence PreservationA formal legal notice served on a third party such as an ISP or cloud provider requiring them to retain specific data that would otherwise be deleted. Preserva...
- Legal and Jurisdictional Frameworks for Mobile and Network Evidence