Could logging in from another device alter the evidence?¶

Yes. A new login creates a session, device and network record and can trigger alerts, authentication challenges, downloads and termination of existing access.

Preserve the original session first¶

Record account, device, page, active session, warnings and linked-device state. A second login can alter trusted devices, apparent location, risk scoring and recent activity.

Consider provider preservation, native export or specialist support before introducing another device. Never use personal equipment or an uncontrolled browser.

Record every part of the new event¶

If justified, use an approved device and capture time, network, credentials process, multi-factor approval and resulting changes. Identify who controlled any approving device.

Preserve new-device alerts, downloaded copies and sessions ended or challenged. The new event must remain distinguishable from the account's earlier history.