First Response & Preservation Operational Explainer
What should I do first when I encounter a locked computer?¶
Record the lock screen, equipment and connected environment without attempting access, restart or automatic disconnection.
A locked system can still reveal useful context about identity, power, network and surrounding authentication equipment.
First priority
Preserve the visible and connected state before changing credentials, power or network.
Record the whole setup¶
Capture:
- every monitor;
- lock screen;
- computer case;
- ports;
- cables;
- external storage;
- smartcards or tokens nearby;
- visible username or account image;
- hostname;
- time;
- network;
- notifications; and
- battery or mains state.
Useful observationSystem locked as
NORTHMERE\daveSupports the account context displayed by the computer.Not establishedDave was the person using itThat still requires wider evidence.
Avoid actions that reduce access¶
Failed password attempts may cause lockout or create logs.
Restart may:
- remove memory;
- end sessions;
- close applications;
- re-engage encryption; or
- remove live state.
Network and power changes can also alter evidence or remote systems.
Escalate important or uncertain systems¶
Encrypted, managed, business-critical or incident-affected computers warrant specialist support before significant state changes.
The practical point is: a locked computer still has an evidential state. Preserve it and seek advice before trying credentials or changing power/network.
