When should removable media be handled only by a specialist?¶

Use specialist handling when connection, removal or ordinary packaging could alter a live system, damage the media, activate malicious behaviour or disrupt an important service.

Escalate for technical risk¶

Specialist advice is appropriate when media is attached to a powered device and a transfer, backup, database or encryption process may be active. It is also needed for damaged, wet, modified or unfamiliar hardware; suspected malware; authentication or cryptocurrency devices; and encrypted or proprietary storage.

Do not remove disks from RAID, network storage, servers or industrial equipment as though they were independent drives. Their order, controller, configuration and service dependencies may be essential to interpreting or recovering the data. Avoid improvised PIN attempts, repair utilities, scans and file-system checks.

Hold the context while help is obtained¶

Record the item, host, power state, connections, labels, visible activity and surrounding equipment. Prevent unnecessary access without changing the configuration simply to make the scene easier to manage. Where the system supports critical business or public-safety functions, preservation and continuity decisions need coordinated ownership.

If immediate action is required to prevent serious harm, use the least destructive effective measure and record why delay was unsafe. Document who advised, when, the information supplied and the action authorised.