Preserve evidence during incident response to enable forensic analysis and maintain legal admissibility.
