What should I ask a witness to preserve?¶

Ask the witness to retain the original device, account and item through which they observed the relevant material, and to avoid further contact or exploration.

Keep the source and the observation together¶

Record the service, account, contact identifier, profile link, date, time and device. Ask the witness not to delete relevant messages, emails, calls, notifications, files, voicemails, applications or screenshots. If screenshots already exist, record when and how they were made rather than treating them as the original.

Obtain the witness's recollection of what was visible and what they did, including any links opened, files downloaded, messages forwarded or other people with access. Their account may explain content that later changes, while the technical source can corroborate identifiers and timing.

Avoid creating new activity¶

Do not instruct the witness to reopen an attachment, revisit a profile, contact a suspect or continue investigating. Disappearing or remotely controlled content may justify specialist or provider-preservation support, but the response should not expose the witness unnecessarily.

Use an approved transfer method suited to the sensitivity and volume. A supplied copy is a derivative and should remain linked to, but distinct from, the original device or account.