What should I consider with a laptop?¶

A laptop combines battery power, portability, wireless connectivity and encryption, which makes first-response decisions particularly sensitive.

Evidential caution: that closing the lid safely preserves the device. It may trigger sleep, hibernation, locking or loss of access to an unlocked and encrypted system.

What this means¶

Photograph the screen, keyboard, ports, cables, docking station, external storage and any visible account or application.

Battery state matters. A low battery may cause unexpected shutdown, while connecting a charger may introduce a data connection or cause system activity.

Wireless connections may remain active through Wi-Fi, Bluetooth or mobile data. Isolation decisions should be device-specific and recorded.

An unlocked laptop may hold active sessions, unsaved work and encryption keys. A restart or power loss may make that evidence inaccessible.

Be alert to remote desktops, virtual machines, cloud applications and corporate management tools. The visible laptop may be only the access point to evidence held elsewhere.

What to check or do next¶

• Record whether the laptop is open or closed, powered on, locked or unlocked, charging and connected to any network or peripheral.
• Do not close the lid, press the power button or remove the charger without understanding the likely effect. The device may continue running on battery even after external power is removed.
• If the device is damaged, overheating or presents an electrical risk, safety takes priority. Record the condition and obtain appropriate support.

Evidential limits¶

Where uncertainty exists, preserve the visible state and seek specialist advice before changing power, lid position or connectivity.