What should I do when I encounter a logged-in online account?¶

A logged-in online account may provide a temporary opportunity to preserve visible evidence, but it is also an active environment that can change quickly.

Why this matters¶

The dangerous assumption is that being logged in means you should start exploring the account. Navigation may create activity records, mark content as read, trigger synchronisation or alert another user.

What to record and do¶

First, record the account as found. Capture the service, URL, username, email address, profile, tenant or organisation, visible page, time and device context.

Note whether the account appears fully live, cached, remotely accessed or open inside another application or virtual environment.

Do not switch pages, open messages, change settings, refresh content or log out merely because access is available.

Record visible notifications, security warnings, linked-device indicators and any evidence of recent sign-in activity.

Consider whether another user may still be connected or able to alter the account remotely.

Where there is an immediate safeguarding or fraud risk, account security action may be necessary, but the evidential effect should be recorded.

Seek specialist or provider advice where the account is central to the investigation, remotely managed or likely to change quickly.

Preserve the visible state separately from any later examination.

Record whether the account is personal, organisational, delegated or shared, and whether more than one profile or workspace is visible. A logged-in state proves access to the account at that moment, not who originally authenticated or who is controlling it now.

Do not copy account material into personal notes, personal cloud storage or an unapproved device.

Operational takeaway¶

Capture the logged-in account exactly as found, avoid unnecessary navigation and separate preservation from later search, security and attribution decisions.