What should be recorded about connected cables and peripherals?¶

Connected cables and peripherals can show how a device is powered, networked, controlled or linked to other evidence.

Evidential caution: that a cable is just a cable. It may carry power, data, network traffic, video, storage access or control signals, and disconnecting it may alter several systems at once.

What this means¶

Photograph the full setup before moving anything. Capture where each cable begins and ends, the ports used, any labels and the relationship between the device, monitor, router, storage unit, docking station or other equipment.

Where labels or serial numbers are visible, preserve them exactly. Include photographs that show both close detail and the wider context.

Be alert to apparently ordinary charging cables. Some support data transfer, and connecting or disconnecting them may cause the device to react.

Where the setup is complex, industrial, medical, security-related or part of critical infrastructure, seek specialist support before altering connections.

What to check or do next¶

• Record connected keyboards, mice, monitors, printers, scanners, cameras, external drives, memory-card readers, USB hubs, security keys, charging equipment and network adapters.
• Do not unplug items merely to identify them. A connected external drive may contain mounted evidence. A hardware security key may support an active session. A network cable may link to a wider business system.
• Record whether any peripheral has its own display, status lights, storage or controls. Some printers, routers, cameras and smart devices retain logs or data independently of the main device.
• If a cable has already been disconnected, record who disconnected it, when and why. Do not reconnect it without considering the evidential and operational effect.