What should I record about open windows and applications?¶

Open windows and applications can show what the computer was doing and what evidence may be lost if the state changes.

Why this matters¶

The dangerous assumption is that an application can be closed and reopened later without consequence. Unsaved data, live sessions, temporary content and remote connections may not return in the same form.

What to record and do¶

Record the entire screen before focusing on individual windows.

Capture application names, window titles, browser tabs, document names, visible account details, prompts, alerts and timestamps.

Note which window is in the foreground and which applications are visible in the background.

Do not move, resize, minimise or close windows simply to improve the view. Those actions can alter recent activity, expose new content or end sessions.

Record whether any window appears to be a remote desktop, virtual machine, command prompt, cloud application or administrative console.

Capture visible file paths, server names, usernames, channel names and conversation titles.

If several monitors are connected, record each screen and its relationship to the computer.

Be alert to unsaved work, draft messages and temporary data.

If a prompt requires a decision, photograph it before responding and seek advice where the effect is uncertain.

Record whether any application shows a draft, unsaved marker, progress bar, upload, download or active call. These indicators may explain later changes and may disappear if the window is moved or the application loses focus.

If more than one user session is visible, record which session is active and whether others appear disconnected, locked or running in the background.

Operational takeaway¶

Record all open windows, applications and session context as found before switching, moving or closing anything.