What should I do first when I encounter a locked computer?¶

A locked computer may still provide useful evidence about its condition, connections and recent activity.

Why this matters¶

The dangerous assumption is that nothing useful can be preserved until the computer is unlocked. The lock screen, connected equipment and surrounding system may already show important context.

What to record and do¶

Record the computer as found. Photograph the screen, case, cables, ports, connected storage, monitors and the wider setup.

Capture any visible username, account image, hostname, time, network status, battery or power indicators and lock-screen notifications.

Do not make repeated password attempts. Failed attempts may create logs, cause lockouts or trigger stronger security controls.

Do not restart the computer to resolve access. Restart may remove volatile evidence, close sessions and re-enable encryption.

Consider whether the computer is connected to a network, remote session, docking station or external storage.

Record whether it appears asleep, locked, powered off or waiting for authentication.

Do not disconnect power or network automatically. The correct decision depends on the evidence that may be live and the risk of continued activity.

Preserve nearby notes, security tokens, smartcards and connected devices without using them.

Where the system is encrypted, business-critical or involved in an active incident, seek specialist support quickly.

Document any action taken and any change in state.

Record whether the computer is part of a workplace domain, shared environment or managed network, because another administrator may retain control. Note any smartcard reader, hardware token or external authentication device without attempting to use it.

Operational takeaway¶

Record the locked computer’s visible state, connections and surroundings, avoid access attempts or restart, and obtain specialist advice before altering power or connectivity.