What is the overall investigator checklist for first response and preservation?¶

The overall first-response checklist is a decision sequence: recognise the digital issue, preserve the original state, control immediate risk and know when to stop.

Avoid this assumption: One universal handling rule applies to every device, account or live system. The correct response depends on power, connectivity, volatility, ownership, active harm and operational context.

First, define the investigative question. What might this device, account, service or system contribute?

Record who found or controls it, where it was located and who may have used or administered it.

Photograph or capture the original state before interaction where practicable.

Record power, battery, screen, time, time zone, network connection, cables, peripherals, removable media, logged-in accounts, open applications, notifications and visible identifiers.

Identify what may be volatile or remotely altered.

Consider whether immediate safeguarding, containment or service protection must take priority.

Use the least destructive effective action and document the decision, authority, timing and result.

Do not automatically switch off, disconnect, unlock, charge, restart, log out, change credentials, revoke sessions, open files or connect unknown media.

Preserve provider and organisational records where retention may be short.

Maintain continuity for every device, file, export, copy and handover.

Record investigator-created changes, uncertainty, specialist advice and decisions not to seize or preserve.

Keep technical evidence separate from personal attribution.

Seek specialist support where the system is live, encrypted, damaged, shared, business-critical, malicious or technically unfamiliar.

Finally, stop once first response is complete and hand over with a clear investigative question.

Operational takeaway¶

Define the question, preserve the original state, assess volatility and harm, take the least destructive justified action, document everything and stop when specialist work begins.