Direct answer
Collect only authorized evidence needed for the investigation, record its source and collection context, preserve integrity and restrict access according to the incident response plan.
Agree on collection scope
Identify the device, incident lead, collection authority, relevant time range and data that may contain personal information or credentials. Coordinate with legal and privacy teams where required. Avoid running ad hoc cleanup that destroys evidence before responders decide what to preserve.
Capture provenance
Record the collector, device identifier, time and timezone, method, tool version and storage location. Where appropriate, calculate a cryptographic hash of an evidence file and record transfers in a chain-of-custody log. Microsoft describes investigation package collection for supported Defender deployments.
Reference: Microsoft: Collect an investigation package.
Store and share minimally
Restrict access and use approved encryption, retention and transfer systems. Redact credentials and unrelated personal information from broader reports while preserving the original in restricted storage. Document gaps, collection errors and actions that changed the device state.
Preserve an evidence transfer record
For a diagnostic archive, record a restricted case identifier, collecting operator, collection time and device identifier. Calculate and retain the approved file hash where appropriate, then log each transfer and recipient. If a tool changes the endpoint or a collection fails, record that fact so another investigator can assess the evidence's limits.
Assessment limits
A collection package is not necessarily a complete forensic image. Legal requirements and preservation methods depend on the incident and jurisdiction; involve qualified responders when needed.
Frequently asked questions
Does collecting a package preserve all evidence?
No. Understand the package's contents and limits and follow the incident team's collection plan.
Why record the collection time and timezone?
They help correlate device events with logs and actions from other systems.
Should evidence be shared in an ordinary chat?
Use the approved restricted storage and transfer process because artifacts may contain sensitive data.
Primary sources and further reading
These guides combine published security guidance with practical assessment planning. Adapt checks to the owner's policy, environment, and authorized scope.
This guide was prepared with AI assistance using the linked sources and illustrative examples. Check current vendor guidance and your environment before making changes.