Skip to main content
Industrial site secured following an equipment incident

Investigation Practice

Evidence Preservation in the First 48 Hours

The decisions made before an engineer arrives determine what any later investigation can establish.

UEI
ZR3PJZEA7A21
CAGE
174X8
Independence
Findings challenged before release
Deployment
Remote response within 24 hours

Operational pressure to restore production is legitimate. So is the need to protect the technical record. The two can coexist if preservation is treated as a defined task with an owner.

01

Volatile evidence first

Historian data, control system logs, alarm records, and video are often overwritten on fixed cycles. Export and secure them before anything is disassembled.

  • Extend or freeze data historian retention
  • Export controller, relay, and UPS event logs
  • Photograph as found conditions before movement
  • Bag, tag, and control failed components
  • Record witness observations while recent
You cannot recover data that was overwritten while deciding who to call.

02

Restoration and preservation are not opposites

A short, documented preservation protocol usually costs hours, not days, and protects the ability to answer causation questions that surface weeks later in a claim or dispute.

Need this question examined in a specific matter?

We will help define the evidence, disciplines, and next step required to answer it.

Submit an Assignment