How to Preserve Deepfake Evidence: A Step-by-Step Guide for Incident Teams

Why deepfake evidence needs careful preservation

Deepfake evidence is fragile in two ways. The content disappears: posts are deleted, accounts are suspended and links expire, often within hours of an incident becoming public. And the file itself degrades: every time a video is downloaded through a social app, screen-recorded or forwarded through a messaging service, it is usually re-compressed and stripped of metadata, which removes some of the traces forensic analysis looks for.

Preservation also decides whether the evidence will be trusted later. An insurer, an employment tribunal, a regulator or a court will ask where the file came from, who has handled it and whether it has changed. A record made at the time answers those questions; a reconstruction made weeks later rarely does.

Good preservation also protects people who are wrongly accused. When a real recording is dismissed as a deepfake, or a fabricated one is presented as real, the side with a documented original, a recorded hash and a clean custody log is in a far stronger position than the side with a forwarded clip.

How to preserve deepfake evidence, step by step

Work through these steps in order as soon as an incident starts. They follow the principles in ISO/IEC 27037:2012, the international guideline for identification, collection, acquisition and preservation of digital evidence, and the Scientific Working Group on Digital Evidence's authentication guidance.

• Identify the best source: the original device, the account that first posted it, the email attachment or the platform's own export.
• Acquire the native file without converting it, and download it directly rather than screen-recording.
• Record acquisition details: who collected it, when, from where, with what tool, and the original file name and size.
• Compute a SHA-256 hash of the original and record it in the evidence log.
• Store the original read-only in a restricted location, with a second copy elsewhere.
• Create working copies for analysis and record their hashes too.
• Capture context: URL, account ID and display name, caption, comments, timestamps and the surrounding messages.
• Log every handoff in a chain-of-custody record, re-checking the hash each time.

Keeping originals apart from working copies

The original should never be the file anyone works on. Analysts, reviewers and lawyers all get copies. If a tool needs a different format, convert a copy and note the conversion. This lets anyone show later that the original is unchanged, because its hash still matches the value recorded on the first day.

Some changes happen without anyone intending them. Opening a photo in an editor and saving it re-encodes the pixels. Some phones and cloud services rewrite metadata on sync. Messaging apps compress media on send. Treat every tool as a possible source of change and record what each one did.

Capturing the context around the media

Many synthetic media cases are decided by context rather than by the file. Record the URL, the account handle and its numeric ID if the platform shows one, the display name and profile image at the time, the caption, the posting time and time zone, and visible engagement such as shares and replies. For messages, keep the full thread, not just the item with the media.

Open-source investigators follow a similar discipline. The Berkeley Protocol on Digital Open Source Investigations, published by the UN Office of the High Commissioner for Human Rights in 2022, sets out methods for gathering, analysing and preserving online information in a professional, legal and ethical manner, including recording how each item was found.

If the file carries Content Credentials under the C2PA specification, preserve it unchanged so the manifest stays intact and can be validated. A missing manifest says nothing about authenticity, because many tools and platforms strip it.

Handling sensitive and intimate media

Evidence that shows intimate images, children or violence needs a different approach. Collect the minimum needed, restrict access to named people, and prefer safe records such as URLs, hashes and platform report numbers over extra copies. Never forward sexual images of minors; report them to the appropriate hotline and let law enforcement collect them.

Victims should not be asked to send the same content repeatedly. Record what has been collected and by whom so that each team can refer to one preserved copy.

Store sensitive evidence encrypted, log every access, and set a retention period agreed with legal so that material is deleted when the case closes rather than kept indefinitely on shared drives or personal devices.

Preparing a forensic handoff with NeuroDetect

Once the evidence is preserved, analysis should be reproducible: another examiner using the same file and tools should reach the same findings. That means recording the tool, the model version, the settings and the hash of the file analysed.

Neural Defend's NeuroDetect is built around that requirement. An authorized analyst uploads the preserved image, audio, video or document into a case, and each analysis keeps its model and version context. Explainability heatmaps and attention views point to the regions, frames and audio segments behind a finding. A plain-language summary links back to the evidence, and the analyst makes the final call. The downloadable forensic report records observations, uncertainty, provenance, model context and analyst notes, and structured results can be exported to a case management system.

For sensitive cases, Neural Defend supports private cloud, on-premises and air-gapped deployment, so preserved evidence does not need to leave the organization, and holds ISO/IEC 27001, ISO/IEC 27701 and SOC 2 Type II certifications.