Answer
Preserve the relevant logs, timestamps, configuration, app version and other incident data using a controlled copy process before normal use can overwrite or change it.
Explanation
Digital evidence can be fragile even when the physical aircraft is intact.