What identifiers should be preserved immediately?¶

When digital material may be relevant, identifiers are what allow the device, account, service or session to be linked to later enquiries.

Evidential caution: that a visible name is enough. Display names can be changed, duplicated or misleading. The useful identifier is often a less obvious account ID, device serial number, phone number, email address, username, session reference or provider-generated code.

What this means¶

Link each identifier to its context. Record where it appeared, on which device or service, under which account and at what time. An identifier without context may later be difficult to interpret.

Avoid digging through menus simply to collect every possible identifier. Some identifiers can be obtained later through settings, provider records, specialist examination or organisational documentation. The immediate task is to preserve what may disappear and what is needed to identify the correct target.

Be alert to aliases. A profile name, device label or contact name may describe how another user saved the account, not the account’s true identifier. Preserve both the label and the underlying identifier where visible.

What to check or do next¶

• Preserve identifiers that are already visible without unnecessary navigation. Depending on the situation, that may include usernames, email addresses, phone numbers, account handles, profile URLs, device names, serial numbers, IMEI numbers, SIM identifiers, IP addresses, hostnames, asset tags, wallet addresses, case references, tenant names, organisation IDs and visible session or alert identifiers.
• Record the exact format. A single missing character can point to a different account or make a provider request fail. Do not paraphrase or correct what appears on screen. Capture it exactly, including punctuation, capitalisation and any leading zeros.
• If an identifier is partly obscured, record exactly what can be seen and that the remainder was not visible. Do not guess.