Why is the original state important?¶

The original state gives you the best available record of how the device, account or system appeared before your actions changed it.

Evidential caution: that the system will remain stable while you decide what to do. It may not. Screens lock, sessions expire, notifications disappear, cloud services synchronise, remote users make changes and devices continue writing new data simply because they are switched on.

What this means¶

The original state helps distinguish what existed before intervention from what happened afterwards. That distinction matters when explaining visible content, account status, network connections, timestamps, open applications and any changes caused by an investigator, user, administrator or provider.

Photographs, contemporaneous notes and externally recorded video may help. Screenshots can also be useful, but they may create files, notifications or audit records. Use the least intrusive method that captures the necessary detail.

The original state also supports later specialist work. A forensic practitioner can better interpret a device when they know whether it was powered on, unlocked, connected, charging, logged in or actively running an application.

What to check or do next¶

• Record the whole context, not just the item that first attracted attention. A single message may be relevant, but the surrounding account, date, visible username, device state and active connection may determine how that message should be interpreted.

Evidential limits¶

Preserving the original state does not mean freezing every technical process. That may be impossible. It means documenting what could reasonably be observed before making avoidable changes.

Be precise about uncertainty. If the screen had already changed before you arrived, say so. If another person handled the device, record what they report doing. Do not reconstruct an earlier state and present it as if you personally observed it.