Preservation
Data preservation is not a passive act. It is a deliberate, documented process that protects the integrity of potentially relevant information from the moment a legal obligation arises through to its use in proceedings. A single misstep in the preservation process, an improperly handled acquisition, an undocumented methodology, or a gap in the chain of custody, can render findings unusable regardless of how important the underlying data turns out to be.
Gemean supports the full data preservation process, from acquisition through chain-of-custody maintenance, ensuring that the integrity of the data is protected and that the methodology used to preserve it can be demonstrated and defended at any stage of the proceedings.
Targeted Data Acquisition
Preservation begins with identifying exactly what needs to be collected and acquiring it in a manner that does not alter or damage the underlying data. Gemean's preservation professionals conduct targeted acquisitions across the full range of data sources, using forensically sound methods that preserve the evidentiary integrity of everything collected.
Chain of Custody Documentation
Every preservation action needs to be documented from the moment of collection. Gemean maintains a complete, unbroken chain of custody for every piece of data preserved, recording each action taken so that the integrity of the evidence can be demonstrated at any point in the proceedings.
Forensically Sound Methodology
Preservation methodology that cannot be explained, reproduced, and defended is preservation that creates risk rather than managing it. Gemean applies documented, repeatable forensic methodology to every preservation engagement, ensuring that the process meets the evidentiary standards courts and regulators apply.
Volatile Data Capture
Some of the most critical evidence exists only in a system's active memory and disappears the moment a device is powered down or a session ends. Gemean's preservation professionals identify and capture volatile data before it is lost, preserving evidence that would otherwise be permanently unrecoverable.
Secure Evidence Storage
Proper preservation does not end at collection. Gemean maintains secure storage environments throughout every engagement, ensuring that preserved data remains intact, protected from unauthorized access or alteration, and available for review at every stage of the matter.
Cross-Platform Preservation
Modern data environments include cloud platforms, collaboration tools, mobile devices, legacy systems, and dozens of SaaS applications, each with its own retention logic and technical requirements for preservation. Gemean conducts preservation across all relevant platforms simultaneously, ensuring that nothing relevant is missed because it lived on a system nobody thought to include.
Why Clients Choose Us
Forensically Sound Methodology
Rapid Mobilization
Complete Chain of Custody
Cross-Platform Coverage
What gets preserved in the first hours determines what the matter has to work with.
What is data preservation and how is it different from data collection?
Preservation suspends normal deletion routines and protects data from alteration so it remains available for collection. Collection is the process of acquiring a copy of that data for review and analysis. The two are distinct obligations with distinct documentation requirements. Preservation must be immediate and comprehensive. Collection can be more targeted and methodical. Failing to distinguish between them is one of the most common sources of spoliation risk. Gemean’s legal hold and digital forensics and investigations teams manage both obligations in parallel, ensuring that the evidence tracker record is complete from the first preservation action through to production.
What makes a preservation methodology forensically sound?
A forensically sound preservation methodology produces a verified copy of the original data without altering it, documents every step in sufficient detail that another qualified examiner could reproduce the same result, and maintains an unbroken chain of custody from collection through presentation. The methodology must be explainable to a non-technical audience, reproducible under challenge, and consistent with recognized forensic standards. Gemean’s digital forensics consultants and ediscovery forensics experts apply these standards across every preservation engagement, whether the matter involves e-discovery cyber security, forensic accounting audit and investigation, or enterprise ediscovery services.
How quickly does preservation need to happen after a legal hold is triggered?
As quickly as possible. Volatile data including active memory, running processes, and session-level information disappears within seconds to minutes of a device being powered down. Collaboration platform messages may be subject to short retention windows running continuously. In most matters, the first hours after a legal hold is triggered are the most consequential for what the investigation ultimately has to work with. Gemean’s digital forensic investigators and legal hold management team are structured to mobilize within 24 hours for urgent matters, ensuring preservation begins before critical evidence is lost.
What happens if data that should have been preserved was not?
If data subject to a legal hold obligation was lost or destroyed after that obligation arose, the organization faces potential spoliation sanctions. The appropriate response is to document what is known about the lost data, investigate the circumstances of its loss, and engage legal counsel immediately. Attempting to recreate or substitute for lost data without counsel’s guidance significantly compounds the exposure. Gemean’s forensic consultants and ediscovery forensics experts assist organizations in documenting and responding to preservation failures in a way that minimizes further risk.
Can preservation be conducted across cloud environments?
Yes. Cloud preservation requires familiarity with the specific retention logic, API access methods, and technical constraints of each platform involved. Gemean has experience preserving data across cloud environments including Microsoft 365, Google Workspace, Slack, Salesforce, and dozens of other platforms, using native preservation capabilities where available and supplementing with forensic collection methods where they are not. This capability is central to Gemean’s enterprise ediscovery services, legal hold management, and e-discovery cyber security practice, ensuring that cloud-hosted data is preserved to the same evidentiary standard as on-premise ESI.