When should I avoid interacting with the device or account?¶

You should avoid interacting when the likely evidential effect of your action is unclear or when the material can be preserved without touching the system.

Evidential caution: that a quick look cannot do any harm. Opening an application, unlocking a screen, refreshing a page, checking settings or logging into an account may create records, change timestamps, trigger synchronisation or alert another user.

What this means¶

Avoid interaction where the device or account is already displaying useful information that can be recorded externally. Photograph what is visible first and preserve the surrounding context.

Stop before interacting if the device may contain volatile live evidence, if remote access may be active, if encryption or screen locking may be affected or if an incorrect action could cause data loss. This is particularly important with servers, business systems, unfamiliar network equipment, active cyber incidents and specialist security tools.

Interaction may still be justified where there is an immediate threat to life, safeguarding concern, active loss, continuing fraud or serious operational risk. In those circumstances, record why intervention was necessary and what was changed.

Consider whether the same objective can be achieved less intrusively. A photograph may preserve a visible account ID without opening the profile. A provider preservation request may protect records without logging into the account. A specialist may be able to capture live evidence more safely.

What to check or do next¶

• If you do interact, make the minimum necessary change, record the sequence of actions and stop when the objective has been achieved.

Evidential limits¶

Avoid speculative navigation. Do not search through messages, folders, settings or account pages merely because access is available. Preservation is not examination, and lawful authority to possess a device does not automatically answer every question about searching its contents.