Could opening a link expose the device or investigation?¶

Yes. A destination can record network, browser, device, account, referral and unique-token information and can deliver redirects, downloads or malware.

Preserve the link before visiting¶

Record the exact visible and underlying URL, surrounding message, sender, account and time. A unique parameter may identify the recipient and signal investigative activity.

Do not click to discover the destination. Shortened or hidden links require controlled analysis, not an ordinary browser or personal network.

Control any necessary access¶

Where safeguarding or threat assessment requires it, use an approved environment and record device, account, browser, network, time, redirects and prompts.

Do not enter credentials or grant permissions without separate authority. A destination does not by itself identify who created or sent the link.