How should uncertainty about the original state be reported?¶

Uncertainty about the original state should be reported openly, precisely and without attempting to fill gaps through assumption.

Avoid this assumption: A professional record must present a complete and confident account. In digital first response, the original state may already have changed before the investigator arrived.

Record what was directly observed and distinguish it from what was reported by another person.

Identify any prior interaction, including unlocking, charging, moving, disconnecting, forwarding, screenshotting, restarting or account-security action.

Where the timing is unclear, use a range or state that the sequence cannot be established.

Do not describe a device as “untouched” unless that is genuinely supported.

Record missing information, such as an unknown power state, uncertain network connection, changed screen, absent cable or incomplete account history.

Explain why the uncertainty exists and whether it affects preservation, attribution, chronology or interpretation.

Preserve conflicting accounts rather than forcing them into one version.

If photographs, logs or witness evidence partially resolve the issue, record what they establish and what remains unknown.

Do not use technical language to disguise a simple evidential limitation.

Where a specialist may be able to assess the change, record that as a possible next step rather than a certainty.

The record should allow another person to understand both the evidence and the gaps.

Record whether the uncertainty arose before arrival, during preservation or through later handling, because each has a different effect on interpretation.

Operational takeaway¶

Report the original state as observed, reported and uncertain, preserving every limitation that may affect chronology, attribution or the meaning of later evidence.