Could disconnecting a network affect several evidential systems?¶

Yes. One uplink or switch port may carry servers, cameras, access control, telephony, alarms, cloud access and central logs.

Map dependencies before containment¶

Record device, port, cable, interface, equipment and alerts. Virtual networks and shared infrastructure can make one physical connection serve many systems.

Disconnection may stop harm while ending sessions, log forwarding and footage uploads or causing devices to reconnect elsewhere with new addresses.

Use the narrowest control¶

Seek network or incident support for shared systems. If urgent action is required, record why, exact control, operator, time and every service, session, address and alert change.

Keep the post-disconnection state separate from the earlier network evidence.