What should be recorded about power and battery state?¶

Power and battery state can determine whether a device remains accessible, whether live evidence survives and whether urgent action may be needed.

Evidential caution: that power is just an equipment issue. Switching a device off, allowing it to lose power or connecting it to a charger may all change the evidential state.

What this means¶

Where a battery indicator is already visible, record the displayed level. Do not navigate through menus merely to find it unless there is a justified reason.

Consider whether power loss may cause the screen to lock, encryption to re-engage, volatile memory to disappear or unsaved data to be lost. Conversely, leaving the device powered on may allow remote access, synchronisation, updates or continued malicious activity.

What to check or do next¶

• Record whether the device is powered on, powered off, asleep, locked, restarting or displaying a low-battery warning. Note whether the screen is active and whether any applications or sessions are visible.
• Record how the device is powered. Note connected chargers, power cables, docking stations, battery packs, uninterruptible power supplies and removable batteries. Photograph the connections before altering them.
• If the battery is failing, seek specialist advice where practicable. The correct response may depend on the device type, its current accessibility, the likely evidence and the risk of remote activity.
• Record any change in power state, including who caused it, when it happened and why. If the device lost power accidentally, document that clearly rather than implying the original state was preserved.

Evidential limits¶

Do not assume that connecting a charger is harmless. Some cables and ports can carry both power and data, and the device may react to a new connection.