What questions should I ask the person who found or controls the system?¶

The person who found, owns or controls a digital system may know facts that are not visible on the screen and may disappear if they are not recorded early.

Evidential caution: that the device or account will explain itself. It will not tell you who normally uses it, what changed before you arrived, whether someone has remote access or what actions have already been taken.

What to check or do next¶

• Ask what the system is, who owns it, who normally uses it and who else may have access. Establish whether accounts are shared, whether the device is managed by an employer or family member and whether any remote-support tools are in use.
• Ask when the relevant activity was first noticed and what happened immediately before and after it. Find out whether the person opened messages, changed passwords, restarted equipment, disconnected cables, deleted anything, installed software, contacted a provider or attempted to preserve material.
• Ask about the current state. Is the device normally left on? Is it unlocked? Is it connected to Wi-Fi, mobile data, a corporate network, cloud storage or another device? Is it likely to lock, sleep, update or lose power?
• Ask whether anyone else knows the passcode or credentials, whether multi-factor authentication is enabled and whether recovery email addresses, phone numbers or security keys are involved. Do not ask the person to start demonstrating access until the evidential effect has been considered.
• Ask whether there is any immediate safety, safeguarding or business-continuity concern that may require intervention despite preservation risks.
• Record the answers in the person’s own terms and distinguish what they know from what they assume. Where possible, identify the source of their knowledge.
• Do not turn the conversation into a technical interrogation. The purpose is to identify volatility, prior changes, access routes and immediate risks.