When should a first-response line of enquiry stop?¶

Stop when the immediate identification, preservation, safeguarding and escalation decisions are complete and further interaction would become examination, speculation or disproportionate intrusion.

Test whether first response has achieved its purpose¶

Return to the investigative question. Confirm that the relevant source and identifiers have been recorded, the original state preserved proportionately and urgent risks such as remote deletion, compromise, short retention or service harm addressed. Document actions already taken and their effects.

An unlocked device or accessible account is not an invitation to continue searching. More navigation can change the source and create investigator activity without adding evidence needed for the immediate decision.

Hand over at the correct boundary¶

Stop when the next step requires specialist acquisition, forensic examination, provider disclosure, additional legal authority or detailed interpretation. Also stop where expected value is low, operational impact is high or a safer authoritative source answers the same question.

Record why activity ended, what remains unresolved and who owns the next action. Changed circumstances can justify review, but the line of enquiry should not become an open-ended exploratory search.