When should a first-response line of enquiry stop?¶

A first-response line of enquiry should stop when the immediate preservation, safeguarding and escalation decisions have been made and further action would become examination, speculation or unnecessary intrusion.

Avoid this assumption: More interaction always produces more useful evidence. Continuing to navigate, test, search or open material can alter the original state, create investigator activity and move beyond the purpose of first response.

Start by returning to the investigative question.

Ask whether the relevant device, account, system or record has been identified and preserved proportionately.

Check whether urgent risks have been addressed, including remote deletion, ongoing harm, account compromise, service disruption or loss through short retention.

Confirm that the original state, identifiers, power, connectivity, visible accounts, applications, time and nearby systems have been recorded where relevant.

Record any action already taken and its effect.

Stop when the next step requires specialist acquisition, forensic examination, legal authority, provider disclosure or detailed technical interpretation.

Do not continue merely because the device remains unlocked or the account is accessible.

Stop where the expected evidential value is low, the operational impact is high or the same question can be answered from a safer and more authoritative source.

Record why the line of enquiry stopped, what remains unresolved and who should take the next action.

Where circumstances change, the decision can be reviewed, but it should not become an open-ended search.

A disciplined stop protects evidence, proportionality and the investigator from overstating what first response can achieve.

Operational takeaway¶

Stop first-response activity once the immediate evidence, risk and preservation decisions are complete and the next step properly belongs to a specialist, provider or authorised examination.