When should the original device be retained?¶

The original device should be retained when it may contain evidence, context or access that cannot be preserved reliably by a simple copy.

Avoid this assumption: Once screenshots or files have been supplied, the device is no longer needed. The original may hold metadata, account sessions, application state, deleted data, notifications, logs, credentials and links between records.

Retention is more likely to be necessary where authenticity, chronology, attribution or completeness may be disputed.

It may also be required where the material is volatile, disappearing, encrypted, damaged, remotely controlled or stored across several applications.

Record the device, owner or controller, current state, account context, power, network connection and reason for retention.

Consider the impact on a victim, witness, employee or organisation before removing an essential device.

Where possible, provide or arrange a practical alternative for communication, safety, work or care.

Do not retain a device simply because it might contain something useful. The decision should be lawful, proportionate and connected to a defined investigative need.

Record why a native export, screenshot or witness-supplied copy would not be sufficient.

Preserve continuity, packaging, handling and any interaction required before transfer.

Where a device is live or connected to critical services, seek specialist advice before seizure or shutdown.

Review retention as the investigation develops. A device should not remain held longer than necessary merely because it was initially relevant.

Operational takeaway¶

Retain the original device where context, metadata, live access or completeness cannot be preserved adequately by a derivative copy, and document necessity, proportionality and impact.