What should be recorded about network connectivity?¶

Network connectivity affects whether a device can receive new data, synchronise changes, communicate with remote users or be altered from elsewhere.

Evidential caution: that a device is either simply online or offline. It may have several active connection routes at the same time, including Wi-Fi, mobile data, Ethernet, Bluetooth, VPN, remote desktop or a tethered connection.

What this means¶

Photograph connected cables and the wider setup. A cable may link the device to a router, switch, storage system, docking station or another device. Do not disconnect it until the likely effect is understood.

Be cautious about opening network settings. Doing so may generate records, expose sensitive information, trigger reconnection or cause accidental changes.

Remember that a device may continue communicating when the screen appears inactive. Background synchronisation, remote management, cloud backup and messaging services may still operate.

Equally, an apparently disconnected device may reconnect automatically when moved, restarted or brought within range of a known network.

Where the system is part of a business network, server environment or active incident, seek specialist support before disconnecting it. One cable may affect many users or evidential systems.

What to check or do next¶

• Record what is visibly connected before changing anything. Note Wi-Fi or mobile-signal indicators, Ethernet cables, VPN icons, Bluetooth status, remote-access warnings and any displayed network name.
• Record any visible IP address, hostname, network name, remote session, connected-user indicator or security alert. Preserve exact identifiers rather than summarising them.
• If isolation is being considered, document the existing connection state first. The value of an isolation decision depends partly on what connections were present and what evidence or operational function they supported.