If evidence is not secured correctly or quickly enough, this may result in the loss of important data that cannot be recovered later. In the worst case, this will result in a forensic examination that produces no findings. At minimum, however, the value of the evidence will be limited.

The risk of losing important evidence increases significantly if employees use forensic tools incorrectly, secure data too slowly, or practise too little. In addition, evidence often gets lost if the persons in charge do not identify volatile data as relevant and thus fail to secure it.