Should a victim continue using the affected device?¶

There is no automatic answer. Continued use may change evidence or expose the victim, but removing their only means of communication, banking, work or healthcare can create greater immediate harm.

Assess the live risk and the practical dependency¶

Establish whether the device appears monitored, remotely controlled, infected, used for fraud or likely to receive further harmful contact. Record its current messages, alerts, accounts, connections, time and unusual behaviour. At the same time, identify what essential functions the victim would lose and whether a safe alternative device or contact route is available.

Serious ongoing harm requires prompt specialist and safeguarding support. Network isolation may reduce remote access, but can also interrupt synchronisation, messages and location records, so its consequences need to be considered.

Define any necessary continued use¶

If limited use is unavoidable, agree what the victim can safely do and avoid opening links, installing software, deleting content, changing settings or contacting the suspected offender. Record each unavoidable use after the preservation decision because it may create new application, account and device records.

Do not promise that leaving a device untouched preserves everything; provider-side data and remote activity can still change. Review the arrangement as risks and practical alternatives develop.