Dodgy Dave's betting office is still live when the door opens¶
Dave runs an illegal betting operation around local amateur sport. When investigators arrive, his laptop displays the live settlement sheet, one phone is open to the customer group and another shows incoming payment notifications. Dave has finally achieved real-time business visibility, just not in the way he intended.
Dave's office has a very open plan¶
Laptop DB-14 is awake and connected to two external displays. A browser tab shows cloud sheet BOOK-771; a messaging session shows group Saturday Lines; phone DP-20 displays incoming payment references. A remote cursor is active in the sheet under account settler_2.
A live computer may contain unsaved or memory-only evidence and another user may be connected. The first useful act is to preserve what exists - not chase the cursor around the spreadsheet.
DB-14 · awake · cloud and messaging sessions open.DP-20 · unlocked · payment notifications visible.BOOK-771 · settlement rows updating.settler_2 shown as active in the document.The first record fixes the fleeting state¶
One investigator is nominated for the laptop and another for the phone. Body-worn video records the room, the allocation of handlers and the continuing changes; targeted photographs preserve the small screen text, account names, document ID, visible row references, power, cables and remote-user label. Each handler records their own actions. Open windows and applications and logged-in accounts can change without the device moving an inch.
Dave says the spreadsheet is fantasy sports administration and settler_2 is a software feature. Both propositions can be tested. First responders preserve the labels rather than deciding that Dave's explanation is either charmingly obvious nonsense or definitive proof.
Dave's screens begin changing without assistance¶
New messages and payment notifications continue to arrive. The remote user edits two settlement rows. Leaving everything connected risks further alteration; pulling the cables may end the remote session and remove volatile evidence. A powered-on device can change, while network isolation can also cause evidence loss.
Specialist attendance is not available and remote advice is delayed while the remote user continues editing. Investigators record the options and reject an exploratory search. A nominated handler records the active connection and session identifiers, then carries out the locally authorised isolation action within their training. Their individual note, the body-worn video and the coordinated scene log record the time, reason and visible effect. The decision and isolation action are documented because the post-isolation screen is not the original state.
settler_2 was shown as an active collaborator and changed rows before the recorded isolation.Dave's private browsing keeps the sessions, not the innocence¶
Dave used a private browser window and assumed it meant nothing could be evidenced. Private mode may reduce local history; it does not stop a live page displaying its account and object identifiers or prevent providers recording their own events. The first-response case does not depend on recovering a magical list of everything Dave ever visited.
The cloud provider later preserves version and collaboration events for BOOK-771. The messaging provider supplies group and account records under the appropriate process. Payment records carry the same event references visible on the phone. Each provider observes a different part of the operation.
settler_2 changing row SL-208.MSG-9041.SL-208.The close timing and distinctive reference are circumstantially strong because cloud, messaging, payment and scene records are not simply restating one provider's conclusion.
The handover turns visibility into a proper investigation¶
First responders do not search every group conversation or export the cloud sheet at the scene. Devices, original-state records, body-worn video reference, individual handler notes and the coordinated scene log are handed over with continuity preserved. Acquisition is different from preservation, and every change of handler should be recorded.
Later acquisition links Dave's regular account and device to the sessions visible at entry. Cloud history connects settler_2 to another device; camera and venue records identify a likely associate using it. The payment references visible on DP-20 match the settlement rows and customer messages.
