# Incident evidence: preserve what happened without spreading the breach

Source: https://www.web3sec.news/blog/incident-evidence-runbook
Updated: 2026-11-08

Assign owners and record supporting evidence in your team's own system.

- [ ] Open a restricted incident record with UTC timestamps.
- [ ] Separate observations, hypotheses and confirmed conclusions.
- [ ] Record collection source, method, owner and integrity hashes.
- [ ] Protect originals and sanitize shared analysis copies.
- [ ] Test whether a second investigator can reconstruct the sequence.

## References
- [NIST SP 800-61 Rev. 3: incident response](https://csrc.nist.gov/pubs/sp/800/61/r3/final)
- [NIST SP 800-86: forensic techniques in incident response](https://csrc.nist.gov/pubs/sp/800/86/final)