I have encountered a live device, account or digital system. What happens next?¶

The room is controlled, one investigator is nominated to handle the laptop and another records the decision and visible effects.

Establish physical safety and lawful authority. Record who found each item, where it was and who has already touched it. Body-worn video records the scene, spoken decision-making and handling sequence; targeted photographs preserve small screen text, identifiers, power, cables and connections that the video may not capture clearly. What to photograph first and the limitations of photographs and screenshots remain relevant even where video provides a continuous record.

A coordinated scene log does not replace personal accountability. Every person who handles or interacts with a device records their own action, time, reason and observed result. Continuity must identify the actor as well as the device.

Remote advice cannot be obtained for at least 35 minutes and specialist attendance is not authorised within the operational window. Waiting may preserve the desktop but lose Rowan's location.

The options are recorded: leave the devices untouched; wait for support; use only the notification already visible; restore the existing RouteShare window; or begin a wider search. The final option is rejected as unnecessary and uncontrolled. Waiting is rejected because the message indicates movement before 16:40 and Rowan remains at risk.

Immediate intervention can take priority where life, safety or serious continuing harm creates a genuine need. Specialist support being unavailable or too slow does not create a power or competence that the investigator does not possess, but it is a real factor in deciding between proportionate action and delay.

The nominated handler restores the existing RouteShare window and uses its visible “latest position” control. Location share LOC-9042 shows Stonebridge Yard, updated three minutes earlier.

Before the first action, the handler states the objective and intended stopping point on body-worn video. The recorder notes the displayed time. The handler restores the already running application; the recorder photographs the new state. The map initially opens at regional scale, so the handler selects the existing “latest position” control. No history, settings, other account or unrelated message is opened.

The actions are recorded individually: who operated the laptop, what control was used, the exact time, what appeared and what may have changed. Documenting an urgent first-response decision makes the evidential cost visible rather than pretending the post-interaction screen was the original state.

The location is relayed immediately. Responders find Rowan at Stonebridge Yard before the planned movement. The interaction stops because its defined safeguarding objective has been achieved.

The devices remain controlled in their recorded state while exact account, session, share and device identifiers are preserved for the next lawful process.

There is no universal instruction to switch everything off, disconnect every network or place every phone in flight mode. Power loss may place data behind encryption; leaving a device connected may permit remote change. Powered-on evidence can be lost on shutdown, while a powered device can be changed remotely.

The first responders do not improvise a memory capture, forensic copy or full account search. They maintain physical control, record incoming changes and seek the next available competent support. If a further state decision becomes necessary before support is available, the same cycle - objective, authority, options, least intrusive action, individual record and review - is applied again. The UK professional context explains how this sits alongside recognised UK decision-making and digital-evidence principles.

Application, provider, booking, vehicle and acquired-device evidence explains the live scene and connects it strongly to Callum Redd while identifying a second participant.

The handover contains the original-state material, body-worn video reference, each handler's notes, the coordinated scene log, all observed changes and exact identifiers. Preservation, acquisition and examination are different purposes, and every change of handler should be recorded.

RouteShare later records the session state and the two first-response interface events. That does not discredit the evidence: it corroborates the investigators' attributed account of what they did. Provider records associate session WEB-S-8A31 with Callum's recovery number and relevant-time connection. The acquired laptop contains location-share administration history; the phone contains the yardman_8 account and a conversation with a second account. Short-let booking, vehicle and camera records independently place Callum within the relevant sequence.

The first-response interaction did not prove Callum abducted Rowan. It preserved a life-saving opportunity and created precise lines of enquiry. Purchase, account, session, location, booking, vehicle and later device evidence now converge strongly on Callum while exposing the second participant's possible role.