First Response & Preservation Technical Explainer
Could interacting with the screen change the evidence?¶
Yes.
A tap, swipe or scroll can change both what the device displays and what the device or provider records.
The practical rule
Assume every screen interaction can create new evidence and alter existing state.
Small gestures can have several effects¶
A single action may:
- open content;
- mark a message read;
- dismiss a notification;
- change timestamps;
- trigger synchronisation;
- reorder recent items;
- send a read receipt;
- update location; or
- reveal activity to another user.
Before touchOriginal visible stateWhat was already displayed when control was taken.
After touchNew device/provider stateAnything created or changed by the handler's interaction.
Record before interacting¶
Capture:
- whole device;
- current screen;
- application;
- account if visible;
- time;
- battery;
- connection indicators; and
- notifications.
Then decide whether interaction is actually necessary.
If interaction is justified, keep it bounded¶
Record:
- operator;
- exact action;
- time;
- reason; and
- visible result.
Photograph the changed state separately.
If the device behaves unexpectedly, becomes unstable or shows damage, stop and seek support.
The practical point is: preserve the original screen first, then treat every deliberate touch as a new evidential event.
