First Response & Preservation Operational Explainer

What should I do first when I encounter an unlocked computer?¶

Record the complete live state before interacting with it.

An unlocked computer may expose valuable sessions, applications and remote systems, but casual mouse or keyboard use can change all of them.

First priority

Capture what is already open before deciding whether any interaction is justified.

Record the workspace¶

Photograph:

every screen;
foreground application;
visible background windows;
logged-in account;
time;
network state;
connected devices;
hostnames;
paths;
warnings; and
visible remote sessions.

Example live-computer note

Screen 1: browser · cloud admin portalScreen 2: PowerShell windowAccount: northmere\daveVPN: connectedRemote desktop: active

Access is not permission to explore¶

Do not:

browse folders;
switch applications;
move windows;
open messages; or
type commands

simply because the computer is unlocked.

Could moving the mouse or pressing a key alter the evidence? explains why even small input can matter.

Protect the live opportunity deliberately¶

Consider:

automatic lock;
sleep;
power loss;
encryption;
remote access;
malicious activity; and
whether the visible content is local or remote.

Do not disconnect power or network automatically.

The practical point is: an unlocked computer is a live system, not a static exhibit. Record the whole workspace first and keep any later interaction bounded and attributable.