First Response & Preservation Operational Explainer
What should I record about open windows and applications?¶
Record the entire live workspace before moving, switching, minimising or closing anything.
One visible window rarely tells the whole story.
What to preserve
Foreground, background, prompts, tabs, remote sessions and every connected screen.
Capture the full workspace¶
Record:
- application names;
- window titles;
- browser tabs;
- documents;
- accounts;
- prompts;
- alerts;
- timestamps;
- file paths;
- server names;
- remote desktops;
- virtual machines;
- command windows; and
- multiple user sessions.
Example live workspace
Monitor 1: Chrome · 7 tabsMonitor 2: RDP session ·
SRV-FIN-02Terminal: command prompt openUnsaved document marker: presentWhy background state matters¶
Useful evidence may sit in:
- draft messages;
- unsaved documents;
- active uploads;
- progress bars;
- live calls;
- remote sessions; or
- hidden prompts.
Closing or rearranging windows can change recent activity and hide that context.
Could closing an application destroy useful evidence? covers the next decision.
Keep storage location separate from presentation¶
An open window may display:
- local data;
- cloud-hosted data;
- remote desktop content; or
- virtual-machine content.
Do not assume the physical computer contains the underlying data simply because it is visible on screen.
The practical point is: preserve the whole workspace before touching it. The live arrangement often explains context that a later forensic image cannot recreate.
