What should I record before touching anything?¶

Create a baseline of the scene, item, visible state, connections and time before interaction makes the original condition impossible to reconstruct.

Record the state as encountered¶

Identify where the item is, who is present and who appears to control it. Capture visible make, model, serial or asset labels, usernames, email addresses and telephone numbers without navigating to obtain more.

For a device, note whether it is powered, awake, locked or unlocked; what the screen displays; which applications or conversations are open; and whether warnings, timers, calls or signs of remote access are visible. Record battery and power connections.

Include network and peripheral context: Wi-Fi, mobile, Bluetooth and wired indicators; cables, chargers, storage, security keys, docks and nearby linked devices. Note both the actual observation time and the device or service time, including any visible timezone or discrepancy.

Attribute every later change¶

Use wide photographs to establish context and close images for details. A photograph records appearance, not the underlying data or metadata, so note what it could not capture.

Once interaction begins, maintain a sequence of who acted, what they did, when, why, under whose authority and with what visible result. If safety or an urgent operational need prevented a complete baseline, record that reason and identify anything reconstructed afterwards.

This record gives acquisition and examination a starting point. Without it, a later locked screen, removed cable or ended session may be mistaken for the original condition.