How should a decision not to seize or preserve something be documented?¶

A decision not to seize or preserve a digital item should be documented as carefully as a decision to take it.

Avoid this assumption: No record is needed because no action was taken. Later, the item may become important, disappear or be challenged as an obvious missed opportunity.

Identify the device, account, service, file, system or record considered.

Record where it was found, who controlled it and why it appeared potentially relevant.

State the investigative question it might have answered.

Document the reasons for not seizing or preserving it.

Those reasons may include low evidential value, duplication, legal limits, disproportionality, operational impact, safeguarding concerns, specialist advice or the availability of a better source.

Record what alternatives were considered, such as photographs, identifiers, native export, provider preservation or later acquisition.

Preserve enough information to locate or identify the item again where lawful and appropriate.

Record who made the decision, their authority, the time and the information available.

Do not describe the item as irrelevant merely because it was inconvenient to preserve.

Where the decision depends on an assumption, record that assumption.

Consider whether the position should be reviewed if the investigation changes.

The record should show that the item was recognised, assessed and deliberately left, rather than simply overlooked.

Record whether the item remained under another person’s control and whether there was any immediate risk of alteration, loss or disposal.

Operational takeaway¶

Document every decision not to seize or preserve by identifying the item, its possible value, the alternatives considered and the proportionate reason for leaving it.