What should be preserved from a live command window or console?¶

Preserve enough of the display to identify which system the console controls, which account and location it represents, what command or output is visible, and whether anything is waiting to run.

A command window may be local PowerShell, an SSH session to a server, a cloud shell, a container console or an administrative session inside a virtual machine. The window frame alone may not tell you where the action occurred.

Read the prompt before the command¶

Consider this fictional display:

The first prompt shows a local Windows user starting SSH. The second shows a shell on web-02.example. The final line appears incomplete: pressing Enter could execute it once a destination is supplied, while Control-C could cancel it. Either action would change the original state.

The display may establish that this session contained those commands and output. It does not prove who typed them; pasted text, scripts, shared accounts and remote control remain possible.

Capture the complete context¶

Record, without typing or scrolling where possible:

• application and window title;
• prompt, username, hostname and working path;
• local, remote, cloud, virtual or container context;
• visible command and output, including errors and warnings;
• cursor position and any partly typed command;
• timestamps or elapsed time where displayed;
• surrounding windows, alerts and network state; and
• the system clock and time zone.

Photograph the complete screen and then closer readable views where needed. Keep the image sequence and times so the relationship between windows is clear.

One key can materially change the evidence¶

Do not press Enter, arrow keys, Tab, Control-C or Page Up simply to explore. Those keys can execute input, recall or replace command text, complete a path, terminate a process or alter what is visible. Closing the window can end a remote session or running task.

If the console appears to control active harm, critical infrastructure or malware, preserve the key identifiers where safe and seek live-system or incident-response support immediately. Record every unavoidable input and its result separately from the original observation.