When should I avoid interacting with the device or account?¶

Avoid interaction when the objective can be achieved without touching the system, when the likely effect is unclear or when an error could destroy access or evidence.

Small actions can create material changes¶

Opening an application, refreshing a page, expanding a notification or checking settings can update timestamps, change read status, trigger synchronisation or alert another user. Unlock attempts can exhaust passcode limits; logging in can replace an existing session.

Photograph useful information already displayed before considering more. A visible identifier may be captured externally, and a provider preservation request may protect records without entering the account.

Pause for specialist advice where volatile memory, encryption, remote control or live network activity may be involved, especially with servers, unfamiliar infrastructure, active cyber incidents and business-critical systems. The availability of access is not authority to search, and preservation is not examination.

If action is justified, bound it¶

Interaction may be necessary to protect life, stop continuing loss or address a serious operational risk. Define the precise objective, choose the least intrusive effective action, nominate the handler and set a stopping point.

Record the original state, each control used, the visible result and any unexpected behaviour. Stop once the objective is met or the system behaves differently from expected. One justified action does not permit speculative navigation through other accounts, messages or settings.

The fuller decision record is explained in How should I make and record a digital first-response decision?.