What should be preserved about connected devices?¶

Record each device's technical identifiers, timing and network context without treating a name or address as personal identification.

Preserve the association¶

Capture router, network, time, device name, hostname, MAC, assigned IP, interface and wired or wireless status. Include first-seen, last-seen, lease, signal, access point and trusted or guest labels.

Record whether the list is current, cached, historic or limited to a segment. Do not select, rename, block or disconnect entries.

Account for changing identifiers¶

MAC randomisation, virtual machines, extenders and shared systems can create multiple or misleading entries. If the list changes, preserve both states.

Correlate with device and provider evidence before attributing network presence to a person.