Preservation Basics Checklist

Use this checklist before deep analysis when an agentic event may matter.

Initial Capture

• Identify the task, session, timeframe, affected assets, and involved tools.
• Preserve the original session or trace files before opening them in tools that may mutate state.
• Record collection time, collector, source path, host, and relevant application version.
• Capture current git status, diffs, commits, or artifact hashes when source code changed.

Privacy Review

• Check for secrets, tokens, private prompts, customer data, and proprietary source code.
• Redact public copies by default.
• Keep raw evidence in controlled storage.

Timeline Notes

• Mark each event as observed, derived, redacted, or inferred.
• Link tool calls to tool results where possible.
• Link claimed side effects to independent logs when available.

Before Publication

• Replace real sensitive data with synthetic examples.
• State what the evidence can prove.
• State what the evidence cannot prove.
• Keep uncertainty visible.