Why is the original state important?¶

The original state is the best available baseline for separating what existed before first-response action from what investigators, users, administrators or systems changed afterwards.

Digital scenes continue to change¶

Screens lock, sessions expire, notifications disappear and cloud services synchronise. A powered device writes data even when nobody touches it, while remote users and automated processes may alter accounts or files.

Record the device and its wider setting, not only the item that first attracted attention. Power, access state, screen content, visible account, open applications, connections and time can determine how later records should be interpreted.

External photographs, video and contemporaneous notes can preserve appearance with limited interaction. A device screenshot may add a file or audit event, so use the least intrusive method that captures the necessary detail.

A baseline makes later change explainable¶

Specialists can interpret an acquisition more reliably when they know whether the source was on, unlocked, charging, connected or logged in. The first-response decision record can then distinguish the observed starting point from each intentional or accidental change.

The objective is not to freeze every technical process; that is often impossible. Record what could reasonably be observed and state uncertainty. If somebody handled the device before arrival, attribute their account. Do not reconstruct an earlier display and present it as a personal observation.