How should changes caused by the investigator be recorded?¶

Any change caused by the investigator should be recorded clearly, immediately and separately from the original evidence.

Avoid this assumption: A minor interaction does not matter if the device or account still appears unchanged. Moving a mouse, waking a screen, opening a page, connecting power, enabling isolation or copying a file can create new records or alter the visible state.

Record exactly what was done, who did it, when and why.

Identify the device, account, application, cable, control or setting involved.

Describe the state immediately before the action and what changed afterwards.

Use precise language. Record “pressed the power button once” rather than “checked the device”.

If the action created a notification, timestamp, connection, new file, login event, security alert or session change, record that as well.

Preserve any photograph, screenshot, video, system message or log that shows the change.

Do not hide an investigator-created event because it appears insignificant or embarrassing.

Where the precise effect is unknown, state that uncertainty directly.

Record whether the interaction was deliberate, accidental, unavoidable or carried out on specialist advice.

If several actions occurred, document them separately and in sequence.

Do not overwrite the original notes with a later reconstructed version.

The purpose is not to prove that nothing changed. It is to make the change visible, explainable and capable of being distinguished from user or offender activity.

Operational takeaway¶

Record every investigator-caused change with the action, time, reason, original state and observed result so it can be separated from the underlying evidence.