What should I photograph or capture first?¶

When you first encounter a live device, account or digital system, the priority is to preserve the original state before ordinary activity, automatic updates or your own actions change it.

Evidential caution: that you can always go back and capture the same screen later. You may not be able to. Notifications disappear, screens lock, applications refresh, sessions expire and remote users may alter what is visible.

What this means¶

Photograph the wider scene as well as close detail. A close image of a username is useful, but a wider image may show which device displayed it, what cables were connected and how the equipment was positioned. Preserve both context and detail.

Screenshots may also help, but taking one may itself create a file, notification or audit event. A photograph taken externally is often less intrusive for the first capture.

What to check or do next¶

• Start by capturing what is immediately visible without navigating through the system. That may include the whole device in context, the screen as found, visible applications, open conversations, warning messages, timestamps, connection indicators, battery state and anything showing that the device is unlocked or logged in.
• Do not treat photography as permission to explore. Opening menus, swiping through screens or expanding notifications may create records, alter read status or trigger synchronisation. Record what is already visible first. If further interaction may be necessary, pause and consider whether it is proportionate and whether specialist support is required.
• Where possible, include a reliable reference for date and time, but do not rely on the device clock alone. Record any obvious discrepancy between the displayed time and the actual time.
• Record who took each image, when it was taken and what, if anything, changed before or during the capture.