How should changes caused by the investigator be recorded?¶
Record each investigator-caused change promptly and precisely, with the original state, action, reason, time and observed result kept distinct from underlying activity.
Describe the action, not a vague purpose¶
“Pressed the power button once” is more useful than “checked the device”. Identify the operator, device or account, control, cable, application or setting involved and whether the interaction was planned, accidental, unavoidable or based on specialist advice. Separate multiple actions and retain their order.
Even waking a screen, moving a mouse, opening a page, connecting power, isolating a network or copying a file can create timestamps, alerts, files, connections and session changes. Preserve photographs, screenshots, messages and logs that show the before-and-after position.
Make uncertainty visible¶
If the effect is unknown, say so rather than asserting that nothing changed. Do not hide an event because it seems minor or inconvenient, and do not replace contemporaneous notes with a cleaner retrospective account.
The purpose is not to claim perfect preservation. It is to let later reviewers distinguish responder activity from user, system or offender activity and assess its evidential consequence.
Key takeaway
Record investigator interaction at the level it occurred and preserve its observable consequences so the response footprint remains explainable and separable from the original evidence.
