When should a specialist acquire the material?¶

A specialist should acquire the material when ordinary copying, screenshots or native export may lose important evidence or create unacceptable risk.

Avoid this assumption: Specialist acquisition is required only for damaged or encrypted devices. It may also be necessary where authenticity, deleted data, application databases, metadata, system logs or account attribution are central.

Seek specialist support where the device is live, locked, remotely controlled, malware-infected or likely to lose access.

Escalate where content is disappearing, single-view, encrypted, synchronised across devices or held in a complex cloud or organisational environment.

Specialist acquisition may also be appropriate where the source is a server, virtual machine, network appliance, hardware wallet, RAID system or proprietary device.

Before handover, preserve the original state, visible content, account identifiers, power, network, connected equipment and any action already taken.

Explain the investigative question and what evidence may be lost through ordinary handling.

Do not ask only for a “full download”. The specialist needs to understand the relevant accounts, time period, risks and required outputs.

Record who acquired the material, when, with what authority, from which source and using which method or tool where appropriate.

Preserve continuity for the original device and resulting data.

Where urgent safeguarding action is necessary, do not delay proportionate protection solely to await ideal acquisition, but document the evidential cost.

Record whether the expected output must support immediate safeguarding, operational containment, evidential review or later expert examination.

Operational takeaway¶

Use specialist acquisition when volatility, complexity, authenticity, deleted data or system risk makes ordinary copying incomplete or unsafe, and provide a precise investigative brief.