Could interacting with the screen change the evidence?¶
Yes. Touching or interacting with a phone screen can change both what is visible and what the device records.
Evidential caution: that a tap, swipe or scroll is too minor to matter. It may open content, mark a message as read, change timestamps, trigger synchronisation, dismiss a notification or move the device into a different application state.
What this means¶
Before touching the screen, photograph the whole device and the display as found. Record the visible application, account, time, battery, connectivity and notifications.
Avoid opening menus, expanding notifications, switching applications or scrolling through conversations unless there is a clear lawful and operational reason.
A touch may also reveal your activity to another user through read receipts, typing indicators, location updates or account history.
Screen interaction can alter the order of recent applications, move a conversation to the top of a list or change which content appears in previews.
Where controlled interaction is necessary, use the minimum action required and record exactly what was touched, when and why.
What to check or do next¶
- Do not swipe merely to stop the screen locking unless the evidential value of maintaining access justifies that change.
- If the phone is damaged, wet or unstable, screen interaction may cause additional malfunction.
- Preserve the sequence. If the screen changed after interaction, capture the new state and distinguish it from the original.
- Record whether the interaction was performed by the investigator, the device owner or another person, because that affects continuity and interpretation.
- Do not describe the phone as untouched if any interaction occurred.
Operational takeaway
Assume every screen interaction may create or alter evidence, so capture the original state first and use only the minimum justified touch.