What should be recorded about open applications?¶

Record which application is in the foreground, what it visibly contains and which other applications are open before switching, closing or responding to anything.

An open application describes a live state¶

Capture the full screen, application and window titles, active document or conversation, tabs, prompts, warnings and signs of current activity. Preserve visible account identifiers, server names, file paths, channel names and connected-user information.

Note whether the application appears local, browser-based, remotely hosted or inside a virtual machine or remote desktop. That distinction can identify where the underlying records are likely to be held.

Background applications may still synchronise, communicate, record or hold unsaved data. Bringing a window forward can alter recent-activity records; closing it can save or discard material, terminate a session or remove memory-only evidence. Do not tidy the display.

Unexpected controls require a separate decision¶

If a pop-up requires a choice, photograph it before responding and record why a selection was necessary. Stop and seek support where the application controls machinery, security services, business systems or an active incident; the effect may extend well beyond the visible device.

An open application shows availability and state, not necessarily who opened it or whether its content is complete. Acquisition and provider records may be needed to test the displayed observation.