When should a specialist acquire the material?¶

Use specialist acquisition when ordinary copying or export is likely to lose significant evidence, change a live source or expose people and systems to unacceptable risk.

Recognise complexity and volatility¶

Indicators include locked, damaged, encrypted, malware-affected or remotely controlled devices; disappearing content; application databases; deleted records; disputed authenticity; and synchronised cloud or organisational systems. Servers, virtual machines, network appliances, hardware wallets, multi-disk arrays and proprietary devices may also require configuration-specific handling.

Specialist involvement is not synonymous with a full-device download. The acquisition method should follow the evidential question, source, time period, urgency and expected use of the output.

Provide an acquisition brief¶

Before handover, preserve visible state, identifiers, power, network connections, attached equipment and actions already taken. Explain what might be lost through ordinary handling and whether the immediate purpose is safeguarding, containment, review or later expert analysis.

Record authority, acquirer, time, source, method and resulting data, and maintain continuity for both source and output. Urgent protection should not wait for an ideal acquisition where harm is continuing, but the action and evidential cost must be documented.