- Nationwide Digital Forensic & Cyber Investigation Services
Every platform in a modern business environment keeps evidence for a different length of time, and almost none of those windows are as long as executives assume. This page maps default retention across the platforms examiners see most often, explains the order of volatility that should drive acquisition sequencing, and outlines the legal exposure created when evidence expires before it is preserved.
| Question | One line answer |
|---|---|
| What is the most urgent evidence to preserve? | Volatile evidence such as memory, active sessions, and short retention endpoint telemetry, in that order. |
| Does upgrading a license restore deleted logs? | No. A higher tier changes retention going forward only, it does not recover records already purged. |
| Who decides what to preserve first? | An examiner familiar with the order of volatility, working from an inventory of every platform in scope. |
| Can we get sued for not preserving logs? | Yes, under spoliation doctrine, if a duty to preserve existed and relevant evidence was lost through inaction. |
| Do vendors warn before logs expire? | Rarely. Most platforms silently age out records at the configured retention period. |
| Is a legal hold enough by itself? | No. A hold notice states intent, but automated log deletion continues until someone configures an export or extension. |
| Term | What it means |
|---|---|
| Retention window | The fixed period a platform keeps a category of log data before automatic deletion, set by license tier or configuration. |
| Order of volatility | A prioritization principle stating that evidence should be collected in order from most perishable to least perishable. |
| Legal hold | A directive instructing custodians and systems administrators to suspend routine deletion of data relevant to anticipated litigation. |
| Spoliation | The destruction or material alteration of evidence that a party had a duty to preserve. |
| Log rollover | The process by which a fixed size log file overwrites its oldest entries once capacity is reached, common on network devices. |
| Reporting lag | The delay between an event occurring and its record becoming visible in an audit log interface, which can be hours on some platforms. |
No two platforms treat retention the same way, and the differences are large enough to change the outcome of an investigation. The table below reflects commonly documented defaults; organizations should confirm their specific license tier and configuration, since premium tiers frequently extend these numbers substantially.
| Platform or log type | Typical default retention | Notes |
|---|---|---|
| AWS CloudTrail Event history | 90 days | Console visible event history only; a configured trail delivering to S3 can be retained indefinitely. |
| AWS VPC Flow Logs | As configured | No inherent expiration; retention is entirely a function of the destination storage lifecycle policy. |
| Microsoft 365 unified audit log | 180 days standard | Longer retention, in some cases up to one year or more, is available under higher licensing tiers. |
| Microsoft Entra ID sign in logs | 7 to 30 days | The exact window depends on license level; premium licensing extends the reporting window. |
| Google Workspace admin audit logs | Varies by log type | Different audit categories have different retention periods, and some logs post with a noticeable reporting lag. |
| Windows Security event log | Until configured size is reached | A busy domain controller or file server can roll over in hours to days without centralized forwarding. |
| EDR raw telemetry | 14 to 90 days typical | Extended retention or a dedicated data lake product is usually a separate purchase. |
| Firewall and proxy logs | 30 to 90 days typical | Highly dependent on appliance storage and whether logs are forwarded to a central platform. |
These figures describe defaults, not guarantees. A misconfigured export, a paused forwarding agent, or an unlicensed feature can shorten any of these windows without anyone noticing until the data is needed.
When multiple evidence sources are at risk simultaneously, an examiner sequences acquisition from the most perishable evidence to the least perishable, following the principle formalized in NIST SP 800-86.
Before acquisition begins, an examiner should build a written inventory of every platform in scope, its current retention setting, and whether an export or hold has been placed. This inventory becomes part of the investigative record and demonstrates that preservation decisions were deliberate rather than accidental.
We can inventory your log sources and issue emergency preservation and export requests the same day a breach is suspected.
Once litigation is reasonably anticipated, a duty to preserve relevant evidence attaches under common law and is codified for electronically stored information in Federal Rule of Civil Procedure 37(e). Failing to take reasonable steps to preserve that evidence, when it cannot be restored or replaced, exposes a party to sanctions ranging from an adverse inference instruction to case terminating penalties.
Courts do not require perfection, only that reasonable steps were taken. A documented preservation plan is strong evidence of reasonableness.
The harshest sanctions under Rule 37(e)(2) generally require a showing of intent to deprive another party of the evidence use.
Allowing automated log rotation to continue after a duty to preserve arises can be treated as a failure to preserve, even without bad intent.
An examiner who documents what was preserved, when, and by what method gives counsel a defensible record if preservation is later challenged.
The practical lesson is straightforward: preservation decisions made in the first hours of an incident have legal consequences that can surface months or years later in litigation, regulatory inquiry, or insurance claim disputes.
Organizations that map their log sources and retention settings before an incident respond faster and preserve more when one occurs. A basic preservation readiness plan should be reviewed at least annually.
Inventory every system that generates security relevant logs, including cloud platforms, identity providers, endpoints, and network devices.
Document the default retention setting for each source and flag any that fall below 90 days.
Establish a forwarding pipeline to a centralized log platform with retention independent of the source system default.
Draft a legal hold template and an emergency export procedure that can be executed within hours of a suspected incident.
Identify, in advance, an independent examiner who can be engaged on short notice to direct preservation.
Backups typically capture configuration and data, not necessarily the full audit log stream, and backup retention is often shorter than assumed.
A hold notice states an obligation, but someone still has to configure the system to actually stop rotation or export the data.
License upgrades change retention prospectively. Records that already expired under the old tier are gone.
Internal exports are often scoped to what IT believed was relevant, which may exclude records an examiner later needs.
We help businesses and their counsel move fast in the window that matters most. Our team inventories log sources, issues preservation and export requests across cloud and on premises platforms, and documents every step so the resulting evidence, and the process used to obtain it, can withstand scrutiny.
Same day identification of every log source in scope and its current retention exposure.
Directed exports across cloud, identity, endpoint, and network platforms, hashed and documented.
Practical guidance for counsel drafting hold notices that translate into technical action, not just paperwork.
A pre incident review of retention settings across your environment with prioritized recommendations.
A defensible written record of preservation steps taken, useful if preservation adequacy is later challenged.
Testimony explaining retention practices, preservation timelines, and the basis for conclusions about what evidence existed and when.
Consultations are confidential. We work directly with affected businesses, with outside counsel, and with cyber insurance carriers and brokers nationwide.
Elite Digital Forensics is an independent digital forensics firm serving businesses, attorneys, and insurers nationwide. Our examiners include former law enforcement forensic examiners who have testified as court qualified expert witnesses in state and federal proceedings. We do not sell security software and we do not manage client networks, so our findings carry no conflict of interest when the question is whether an environment was adequately secured.
Every engagement follows documented chain of custody, defensible acquisition methods, and reporting written for attorney review, insurer submission, regulator response, or courtroom use. Work performed at the direction of counsel is generally treated as attorney work product prepared in anticipation of litigation. Call (833) 292-3733 or request a confidential consultation.
It depends heavily on the platform and license tier. Some cloud audit trails default to 90 days or more, while endpoint telemetry and network device logs often survive only 14 to 90 days unless extended retention is purchased or a forwarding pipeline to a central platform exists.
The investigation continues with whatever evidence remains, but conclusions about root cause and initial access may be limited. An examiner will document what is and is not available and explain the impact on the findings.
A hold notice communicates the obligation, but it does not by itself stop automated deletion. Someone still has to configure exports, extend retention settings, or otherwise technically implement the hold.
It is a prioritization framework directing examiners to capture the most perishable evidence first, such as memory and active network state, before durable evidence like disk images and archival logs, which change more slowly.
Sanctions under Rule 37(e) generally require that a duty to preserve had already attached and that reasonable steps were not taken. Genuine lack of anticipated litigation at the time of loss is a relevant factor courts consider.
Either can perform the mechanical steps, but when the adequacy of an organization own security program may be at issue, an independent examiner produces a preservation record that is harder to challenge as self interested.
This content is for educational and informational purposes only and does not constitute legal advice. Elite Digital Forensics provides independent digital forensic services and expert witness testimony; we do not provide legal representation. Every case is fact specific; outcomes depend on the evidence, jurisdiction, and counsel. Retain qualified legal counsel for advice about your matter.
Elite Digital Forensics Assistant
By submitting this form, you consent to be contacted by email, text, or phone. Your information is kept secure and confidential. Reply Stop to opt out at anytime.
IMPORTANT: Please remember to check your spam or junk folder