When should I stop and seek specialist support?¶

Stop and seek specialist support when the next action may materially alter, destroy or expose evidence and you cannot predict the effect with confidence.

Evidential caution: that having access means you should continue. An unlocked screen, administrator account or visible command prompt may create an opportunity, but it may also create significant evidential and operational risk.

What this means¶

Specialist support is particularly important where the system is live, encrypted, remotely managed, connected to critical infrastructure or involved in an active cyber incident. It is also important where volatile memory, active network connections, virtual machines, cloud services or malware may be relevant.

Stop where you are being asked to improvise an acquisition, memory capture, forensic copy or technical containment procedure that you are not trained or equipped to perform. These are not ordinary first-response tasks.

Consider specialist support when lawful authority, provider process or organisational control is unclear. Technical access and legal authority are separate issues.

Before stopping, preserve what can safely be recorded without further interaction. Photograph the screen and physical setup, note power and connectivity, capture visible identifiers and document what has already been done.

What to check or do next¶

• Seek help if the device may lock, wipe, synchronise or lose power and the correct response is uncertain. The same applies where disconnecting equipment could affect other users, services or evidence.
• Provide the specialist with a concise briefing: what the system is, how it was found, what is visible, what has changed, what risk is active and what decision is needed. Do not simply say that the matter is “technical”.
• If immediate safety or operational necessity requires action before help arrives, take the least destructive effective step and record why waiting was not reasonable.