What should be recorded about notifications?¶

Capture each notification exactly as displayed - including its application, account or contact, preview, time and controls - without opening, expanding or dismissing it.

A notification is transient and partial¶

Previews can expose a message, security event or remote action before the display locks or the alert disappears. Record the whole screen first to link the notification to the correct device and state, then take closer images where necessary.

Note whether the device was locked or unlocked. A lock-screen alert does not establish that the associated account was actively open. Relative times, truncated text and operating-system summaries may not reproduce the provider's underlying record.

Opening a notification can mark content as read, launch an application, trigger synchronisation, reveal activity to another user or consume disappearing content. Swiping it away may remove the only visible trace.

Maintain the sequence as new alerts arrive¶

Distinguish notifications present at first observation from those arriving during preservation. Record their order and independent observation time. This prevents later incoming activity from being presented as part of the original state.

If an alert indicates immediate harm, account compromise or active deletion, consider a bounded intervention after preserving what is visible where delay allows. Absence of a notification proves little because settings, connectivity and device state all affect display.