evidence storage or database?

have anyone heard or found out technique use to monitor, manage and protect network traffic as evidence?

example. after crime happen, network traffic was collected as evidence.. how was the standard procedure used to collect and stored? the .pcap file was stored inside database? or the raw file store inside hard disk with a reference pointing to row inside database?

what is the current practice, please share…