What should I record before touching anything?¶

You have found a device, account or digital system that may be relevant. Before you touch it, create a clear record of the condition in which it was encountered.

Evidential caution: that you will remember the original state later. Once a screen changes, a device locks, a cable is removed or a session ends, the earlier condition may be impossible to reconstruct reliably.

What this means¶

Finally, record every action after the initial observation: who acted, what they did, when, why, under whose authority, and what changed. If urgent safeguarding or operational action is required, record the necessity rather than pretending the original state was untouched.

What to check or do next¶

• Start with the scene and the item. Record where it is, who was present, who appears to control it, and how it came to your attention. Note the make, model, visible serial number, asset label, telephone number, username, email address or other identifier where these can be seen without unnecessary interaction.
• Record the power and access state. Is the device on or off? Is the screen awake, locked or unlocked? What is displayed? Which applications, messages, accounts or windows are open? Are there notifications, warning messages, timers, active calls, command windows or signs of remote access?
• Record connectivity and attachments. Note visible Wi-Fi, mobile signal, Bluetooth or wired-network indicators. Photograph connected cables, chargers, removable storage, security keys, docks and peripherals before moving anything. Record nearby devices that may be linked to the same account or system.
• Record time information. Note the actual time of your observation and the time shown by the device or service, including any visible time zone. Differences may matter later.

Evidential limits¶

Use photographs or video where appropriate, but avoid tapping through screens simply to improve the record. A photograph documents appearance; it does not preserve all underlying data or metadata. Write down what you did not capture and why.