First Response & Preservation Technical Explainer
Could a device communicate through a cable?¶
Yes. A cable may carry data, network traffic, commands or authentication as well as power.
That means a phone that looks as though it is “just charging” may still be connected to another computer, dock, vehicle or network.
The short version
Trace both ends before disconnecting. Work out what the cable is doing before treating it as harmless or removing it.
A cable can support several different functions¶
Common possibilities include:
- charging only;
- USB data transfer;
- mounted storage;
- Ethernet;
- screen mirroring;
- debugging or management;
- authentication; and
- specialist device control.
DevicePhone, laptop or applianceThe item you are preserving.
CablePower and/or data pathMay carry more than electricity.
Other endComputer, dock, hub or vehicleMay itself be another evidence source.
Photograph the whole connection¶
Record:
- device port;
- cable;
- adapters;
- hub or dock;
- equipment at the other end;
- labels;
- power state;
- prompts; and
- visible application context.
A security key, external drive or controller may be essential to current access.
Disconnection can remove more than communication¶
Removing the cable may:
- cut power;
- unmount storage;
- terminate authentication;
- close a remote session;
- break a network path; or
- affect another connected system.
Do not reconnect an unknown lead just to test it. Reconnection may start synchronisation, trust prompts or software activity.
Should I disconnect a network cable? covers the network-specific decision.
The practical point is: assume a cable may be carrying evidence or access as well as power. Preserve the relationship before altering it.
