Could moving the mouse or pressing a key alter the evidence?¶

Yes. Moving the mouse or pressing a key can change what the computer records and displays.

Why this matters¶

The dangerous assumption is that waking a screen or checking whether a computer is responsive is harmless. That action may unlock a session, change recent activity, trigger applications or create input records.

What to record and do¶

Before touching anything, photograph the screen and the wider setup.

A mouse movement may wake a sleeping display, reveal notifications or cause a remote session to refresh.

A key press may submit input to an active application, command window, chat or remote system.

If the cursor is already positioned over a button or link, a click may trigger an immediate action.

Do not press Enter, Escape, Control-Alt-Delete or other keys merely to test the computer.

If interaction is necessary to preserve an unlocked state or respond to an urgent risk, use the minimum action required and document it.

Record exactly what was touched, when, by whom and what changed.

Capture the new screen state after interaction and distinguish it from the original.

Where a command prompt, remote desktop or active incident is visible, seek specialist advice before any input.

Do not describe the computer as untouched if the keyboard or mouse was used.

Even moving the mouse may change an inactivity timer, update last-input records or cause a locked screen to display a username. Pressing a key can also send input to a hidden or full-screen application if the display has not refreshed as expected.

Operational takeaway¶

Assume every mouse or keyboard input may alter live evidence, so capture the original state first and interact only where clearly justified.