A live device, account or digital system may be relevant to my investigation — where do I start?¶

You have encountered a phone, computer, online account or live digital system that may matter to the investigation. Your first task is not to explore it. Your first task is to understand what you have, what may change and what must be protected.

Evidential caution: that ordinary interaction is harmless. It may not be. Touching a screen, opening an application, moving a mouse, logging in or reconnecting a device can create new records, change timestamps, trigger synchronisation, expose the investigation or make volatile evidence disappear.

What this means¶

Begin by pausing. Record the original state before taking action. Note what the item is, whether it is powered on, whether it is locked or unlocked, what is visible on screen, which accounts appear open, whether it is connected to a network, and what cables, storage devices or peripherals are attached. Photograph the scene and visible state where appropriate, without treating photographs as a substitute for native records or specialist acquisition.

Then identify the immediate risk. Could another person remotely alter or delete data? Could the device lock, lose power or synchronise changes? Is there an active threat to a victim, the public or an organisation? Preservation is important, but safety and operational necessity may justify intervention. Any unavoidable action should be deliberate, proportionate and recorded.

Where the likely effect of an action is unclear, stop and obtain specialist advice. A controlled delay is often better than an immediate action that destroys the very evidence you are trying to protect.

What to check or do next¶

• Do not confuse preservation with searching. Preservation protects potential evidence. Acquisition creates a controlled copy or capture. Examination looks within that material. Analysis interprets what it means. A first responder should not drift into examination simply because access is available.