dido:02-crusible:05-operational-concept:05-07-preserve-evidence-and-lifecycle-records