First Response & Preservation Technical Explainer

Could isolation cause evidence loss?¶

Yes. Some useful evidence exists only while a device remains connected to a network, cloud service or remote system.

Isolation may protect the device from change while simultaneously removing live evidence.

The trade-off

Isolation can preserve one kind of state and destroy another. The decision should compare the live connectivity risk with the evidence likely to disappear.

What can disappear when connectivity ends?¶

Examples include:

remote desktop or shell sessions;
cloud content that has not been cached locally;
transient messaging content;
live network connections;
central monitoring;
attacker activity visible only through traffic;
authentication state; and
business-service interactions.

Before isolationLive route still visibleRemote session, cloud content and network traffic may be observable.

After isolationRemote route endsProtects against further change but may remove the very activity you were trying to understand.

Record the live context before acting¶

Where time allows, record:

open applications;
active users;
remote sessions;
network indicators;
visible cloud content;
warnings;
connected services; and
whether the displayed content appears local, cached or remote.

This does not require a full forensic examination at the scene. It requires enough context to explain what the isolation changed.

Use the narrowest control that solves the actual problem¶

If only one connection creates the risk, disabling every route may cost more evidence than necessary.

That might mean controlling Wi-Fi while retaining another monitoring path, or disconnecting one network interface while leaving the device powered.

What is device isolation? explains isolation as a route-by-route decision.

Record the cost openly¶

If a session closes or content disappears after isolation, record it.

That is not a failure to be hidden. It is part of the evidential history.

The practical point is: isolation is a trade-off. Protect against the defined risk, but preserve and document the live evidence you are likely to lose.