A digital object rarely arrives with its full history attached. It may be a file copied from a device, material collected from a remote service, an online account, or a record generated by a system. The object matters, but so does the account of where it came from and what happened to it.
What the guidance covers
NISTIR 8387 is written for evidence-management professionals and addresses preservation considerations for several forms of digital evidence. It notes that digital data can be easy to change while also describing techniques that can prevent or detect change. The report focuses on preservation; it does not purport to cover every aspect of acquisition or every jurisdiction’s legal rules.
Preservation is a record of decisions
For a reader trying to understand a digital record, the practical questions extend beyond ‘is this the same file?’ A useful record can make the source, transfer, handling steps, integrity checks, storage and access conditions visible. Those details help a later reviewer understand the process and its limits; they do not, by themselves, establish that an interpretation is correct or that a legal standard has been met.
- Source: what system, device, account or custodian provided the material?
- Transfer: when and how did it move between people or systems?
- Integrity: what checks were performed, with what tools and recorded results?
- Handling: what transformations, exports or access events occurred?
- Limits: what could not be collected, verified or preserved, and why?
Separate the artifact from the interpretation
An integrity check can support a statement about a particular object at particular points in a documented process. It should not be made to carry a broader claim than that. Questions about completeness, provenance, system behavior, meaning and legal admissibility require their own evidence and qualified review.
The systems-design implication is modest but important: preservation procedures, human roles and technical tools should be considered together. A workflow that captures a value but loses its context can make later review harder. Conversely, a clear record helps expose what is known, what is inferred and what remains uncertain.
Evidence and interpretation
Evidence summarized here: NISTIR 8387 identifies preservation challenges for digital evidence and discusses preservation considerations for evidence handlers. Interpretation: documenting source, transfer and handling makes the object’s path more legible to later review. This article does not report original case research, recommend a forensic procedure, or offer legal advice.
Source and limitation
This perspective is grounded in one public NIST report. It is not a systematic literature review, operational protocol or assessment of any agency’s practices. Readers should consult the full report, applicable policy and qualified practitioners for decisions about a particular matter.