Could navigating the account create new records?¶

Yes. Clicks, refreshes and page views can update provider logs, read status, recent activity, synchronisation and collaborative presence.

Viewing is an account event¶

Opening messages, documents, profiles or settings can create timestamps and access records even if the screen appears unchanged. Recommendation order, recent searches and “last active” indicators may also change.

Record current page, URL, account, session, device, time and warnings first. Use less intrusive photographs, provider preservation or specialist processes where they answer the need.

Attribute investigator-created activity¶

If navigation is justified, record each action and result in sequence, including prompts, identifiers, read receipts and alerts. Do not mistake the resulting activity for earlier user conduct.

Maintain a contemporaneous log so provider and device records can distinguish preservation actions from the original timeline.