Skip to main content
Comply Defense
Category: Incident Response & Reporting

Media Preservation

Also known as: Digital Preservation, Audiovisual Preservation
Simply put

Media preservation is the ongoing effort to keep documents, images, recordings, video, and other digital or physical content usable over time, even as the storage media age or become obsolete. It is generally treated as a core part of archival science and library work, focusing on both older (legacy) materials and content that was created digitally from the start. The aim is to sustain access to and the usefulness of content rather than simply to store it.

Formal definition

Media preservation refers to the set of actions taken to maintain the accessibility, integrity, and usefulness of content stored on physical or digital media beyond the limits of media failure and technological or format obsolescence. In practice it encompasses activities such as content ingest, monitoring, reporting, and the sustained management of both legacy audiovisual materials and born-digital content. As applied in archival and library settings, it is a distributed and continuous process rather than a one-time treatment; the specific methods and scope vary by institution. This entry is drawn from general archival, library, and digital preservation sources and does not address defense or public sector cybersecurity compliance requirements, records-retention mandates, or any control frameworks that may govern the handling of specific information types; readers should confirm applicable obligations against current authoritative sources.

Why it matters

Digital and physical media do not remain usable indefinitely. Storage media age, degrade, and fail, while the file formats, hardware, and software needed to read content can become obsolete. Without sustained intervention, documents, images, recordings, and video can become inaccessible even though the underlying bits may still exist somewhere. Media preservation matters because it addresses the gap between merely storing content and keeping it genuinely usable over time, which is treated as a major aspect of archival science.

The distinction between preservation and simple storage is central. As articulated by digital preservation practitioners, preservation refers to all of the actions required to maintain access to materials beyond the limits of media failure and technological or format obsolescence. Institutions such as the Library of Congress treat this as a distributed, continuous effort rather than a single act, spanning activities like content ingest, monitoring, and reporting. This ongoing character means preservation is best understood as a program, not a task that is completed once.

Media preservation is especially important for two categories of material: legacy audiovisual content, which may depend on aging or discontinued playback equipment, and born-digital content, which was created digitally and never had a physical original to fall back on. Sustaining the life and usefulness of both categories requires deliberate, sustained management. This entry addresses archival and library preservation practice; it does not cover defense or public sector cybersecurity compliance, records-retention mandates, or control frameworks, and readers should confirm any such obligations against current authoritative sources.

Who it's relevant to

Archivists and Preservation Specialists
Media preservation is treated as a core part of archival science and library work. Archivists and preservation specialists are responsible for the sustained management of both legacy audiovisual materials and born-digital content, applying continuous processes rather than one-time treatments to keep collections usable.
Libraries and Cultural Heritage Institutions
Libraries and similar institutions maintain media preservation programs to sustain the life and usefulness of their collections. As reflected in efforts at organizations such as the Library of Congress and university libraries, these programs are distributed and ongoing, spanning activities like ingest, monitoring, and reporting.
Custodians of Born-Digital and Audiovisual Content
Anyone responsible for content created digitally from the start, or for aging audiovisual recordings, faces the risks of media failure and format or technological obsolescence. Media preservation provides the framework of ongoing actions needed to maintain access to that content over time.
Compliance and Records Professionals (with a caveat)
Professionals concerned with retention and access may find the concept of media preservation useful, but this entry is drawn from general archival, library, and digital preservation sources. It does not address records-retention mandates, cybersecurity compliance requirements, or control frameworks; readers must confirm applicable obligations against current authoritative sources.

Inside Media Preservation

Preservation Obligation Trigger
The event or circumstance that gives rise to a duty to preserve media, such as reasonably anticipated or pending litigation, a government investigation, an incident response involving Controlled Unclassified Information (CUI), or a specific regulatory or contractual requirement. Practitioners should confirm the applicable trigger against counsel guidance and the governing authority, since the scope and timing differ across contexts.
Scope of Covered Media
The range of storage media and data sources subject to preservation, which may include hard drives, removable media, mobile devices, backups, and cloud-hosted data. The exact scope generally depends on the matter at hand and any tailoring in the applicable policy or contract; what qualifies as in-scope should be verified rather than assumed.
Chain of Custody
The documented record tracking who handled the media, when, and for what purpose, from the point of preservation forward. Maintaining an unbroken chain of custody is generally necessary to support the integrity and admissibility of preserved media in legal or investigative proceedings.
Integrity Verification
Methods used to demonstrate that preserved media has not been altered, such as cryptographic hashing and forensic imaging. In most implementations, integrity is established at the time of collection and re-verified at later points to show the media remains unchanged.
Retention and Disposition Controls
The rules governing how long preserved media must be retained and when and how it may be released from a hold or disposed of. These depend on the applicable legal hold, records schedule, or regulatory requirement, and premature disposition can carry legal or compliance consequences that a reader should confirm against current authoritative sources.
Roles and Responsibilities
The assignment of preservation duties across stakeholders such as legal counsel, information system security personnel, records custodians, and IT operations. Clear role definition helps ensure that preservation actions are executed and documented consistently.

Common questions

Answers to the questions practitioners most commonly ask about Media Preservation.

Does completing media preservation mean the affected system has been secured or remediated?
No. Media preservation is a forensic and evidentiary activity focused on capturing and protecting the state of media so that data is not altered or lost; it is not a security remediation step. Preserving an image of compromised media does not remove an adversary's access, patch the underlying vulnerability, or restore the confidentiality, integrity, or availability of the system. Preservation and remediation are distinct objectives, and organizations should treat preservation as a way to support later analysis, reporting, or legal action rather than as evidence that the environment is now secure. Confirm the specific remediation requirements against your applicable incident response policy and governing guidance.
Is media preservation the same as making a routine backup of the data?
No. A routine operational backup is intended to restore functionality and may not capture the full, unaltered state of the media, may exclude deleted or slack-space data, and typically is not created or handled under evidentiary controls. Media preservation generally emphasizes maintaining the integrity of the original media and creating a defensible record of how the data was captured and handled. Treating a standard backup as an equivalent to a preserved forensic copy can undermine the reliability of later analysis. Verify what your organization's incident response and legal requirements specify for evidentiary handling.
What steps generally support demonstrating that preserved media has not been altered?
Practices commonly used include documenting who handled the media and when, recording the methods and tools used to capture it, and using integrity mechanisms to show the preserved copy matches the source. The goal is to produce a defensible record supporting that the preserved data reflects the original state. The specific controls, tools, and documentation your organization must apply depend on its policies and any legal or regulatory obligations, so confirm requirements against current authoritative sources and, where relevant, legal counsel.
Who should typically be involved when media preservation is required during an incident?
Media preservation often involves coordination among the incident response team, information system security personnel, and, depending on the situation, legal counsel and appropriate management or authorizing officials. Because preservation may have evidentiary and legal implications, early coordination helps ensure handling meets applicable requirements. The exact roles and escalation paths vary by organization and by whether the incident involves CUI, classified systems, or other regulated data, so consult your incident response plan and organizational policy for the specific responsibilities that apply.
How should preserved media be stored and controlled after it is captured?
Preserved media is generally stored in a controlled manner that limits access, protects it from alteration or damage, and maintains a documented record of custody over time. The intent is to keep the preserved data usable and defensible if it is later analyzed or introduced in a proceeding. Storage duration, physical and logical access controls, and handling procedures depend on organizational policy and any applicable legal or contractual obligations, which should be verified against current authoritative sources.
When does the obligation to preserve media typically arise?
Preservation obligations commonly arise when an incident, investigation, or legal matter makes the state of the media potentially relevant, at which point altering or discarding it could be problematic. Because timing can affect both the integrity of the data and legal exposure, organizations often address preservation early in incident handling. The precise triggers and timeframes depend on your incident response policy, applicable regulations, and any legal preservation duties, so confirm these with the relevant authoritative guidance and legal counsel.

Common misconceptions

Media preservation is the same as routine data backup.
Backup supports operational recovery and continuity, whereas media preservation is a deliberate act to protect specific media in a verifiable, defensible state for legal, investigative, or compliance purposes. Preservation generally emphasizes integrity, chain of custody, and controlled retention beyond ordinary backup rotation.
Once media is copied, the original can be reused or disposed of.
Depending on the applicable preservation obligation, originals may need to be retained even after imaging, and premature disposition can undermine integrity or create legal exposure. Whether an original may be released should be confirmed against counsel guidance and the governing requirement rather than assumed.
Media preservation ends once the media is collected.
Preservation is an ongoing obligation that generally continues through the life of the hold, requiring maintained chain of custody, periodic integrity verification, and controlled retention until an authorized disposition or release occurs.

Best practices

Identify the preservation trigger and confirm scope with legal counsel or the responsible authority before taking action, rather than assuming which media and data sources are in scope.
Create forensically sound copies and record cryptographic hashes at the time of collection to establish integrity, and re-verify integrity at defined intervals.
Maintain a complete, unbroken chain of custody documenting every handling event, including who, what, when, and why.
Define and assign clear roles and responsibilities across legal, security, records, and IT stakeholders so preservation actions are executed and documented consistently.
Apply controlled retention and defer any disposition until an authorized release is confirmed against the applicable legal hold, records schedule, or regulatory requirement.
Verify current retention, disposition, and preservation requirements against the governing policy, contract, and authoritative sources, since obligations vary by matter and context.