What should be recorded about open applications?¶

Open applications can show what the device was doing, what data was active and what evidence may be lost if the system changes state.

Evidential caution: that an open application can be closed and reopened later without consequence. Unsaved work, live sessions, temporary data, remote connections and volatile content may not return in the same form.

What this means¶

Avoid switching between applications unless necessary. Even bringing a window to the foreground can change recent-activity records or expose new content.

What to check or do next¶

• Record the application name, visible window title, active document or conversation, open tabs, prompts, warnings and any indication of current activity. Capture the whole screen before taking closer images.
• Note whether several applications are open and which one is in the foreground. Background applications may still be synchronising, recording, communicating or holding unsaved data.
• Do not close applications to make the screen tidier. Closing may save files, discard temporary information, terminate a session, alter timestamps or remove evidence that existed only in memory.
• Record whether the application appears local, browser-based, remotely hosted or running inside a virtual machine or remote desktop. That distinction may affect where the underlying evidence is held.
• Preserve any visible account identifiers, server names, document paths, channel names, conversation titles or connected-user information.
• If an application appears to be controlling machinery, business services, security systems or an active incident, seek specialist support before interacting. The operational consequences may extend far beyond the device in front of you.
• If a pop-up requires an immediate choice, photograph it before responding and record why any selection was made.