When should the original device be retained?¶

Retain the original when a copy cannot reliably preserve the context, metadata, live access or completeness needed to answer a defined investigative question.

Identify what only the device can supply¶

The device may hold account sessions, application state, notifications, logs, deleted records, credentials and relationships between items that screenshots or supplied files omit. Retention is more likely to be necessary when authenticity, chronology or attribution is disputed, or where content is volatile, encrypted, damaged, disappearing or remotely controlled.

Record the device's identity, controller, power, connection and account state and explain why a native export or derivative would be inadequate. A general possibility that something useful exists is not enough; retention must remain lawful, necessary and proportionate.

Account for impact and continuing need¶

Removing a victim's, witness's or organisation's essential device can disrupt safety, communication, work or care. Provide or arrange a practical alternative where possible. Live devices and systems supporting critical services require specialist advice before shutdown or transfer.

Maintain continuity and document any interaction, packaging and handling. Review the need as acquisition and analysis progress, because initial relevance does not justify holding the original longer than necessary.