First Response & Preservation Operational Explainer
When should a mobile-device specialist be contacted immediately?¶
Contact specialist support immediately when delay or incorrect handling could materially reduce live access, create safety risk, or lose evidence that cannot easily be recovered later.
Escalate now when
the next few minutes matter more than the next few hours.
Time-critical technical states¶
Examples include:
- unlocked encrypted phone close to timeout;
- critically low battery;
- credible remote wipe;
- uncertain isolation;
- repeated failed unlock attempts;
- disappearing biometric route;
- live remote session; or
- device behaviour changing in front of you.
Safety-related triggers¶
Immediate specialist or safety support is also appropriate for:
- swelling;
- overheating;
- smoke;
- puncture;
- liquid damage; or
- unstable physical condition.
Operational urgency can matter too¶
Examples include:
- active cyber incident;
- live threat;
- serious safeguarding risk;
- ongoing fraud;
- connected vehicle or wearable changing state; or
- cloud account continuing to alter evidence.
StateWhat is happening now?Unlocked, damaged, changing, low battery or connected.
RiskWhat could be lost or harmed?Access, evidence, safety or ongoing operational control.
DeadlineHow quickly must a decision be made?Minutes, not a vague future handoff.
Give a decision-ready briefing¶
Tell the specialist:
- screen state;
- power;
- battery;
- connections;
- notifications;
- cables;
- identifiers;
- what changed;
- operational objective; and
- decision deadline.
The practical point is: escalate immediately when the next handling choice is time-critical, and give enough state information for the specialist to make that choice.
