Could changing account settings alert another user?¶

An investigator may consider changing a password, privacy setting or linked-device permission to secure an account.

Evidential caution: that the change affects only the device being examined.

What this means¶

Messaging services may send security notifications, emails, SMS alerts or in-application warnings when passwords, recovery details, devices or privacy settings change.

Other active sessions may be logged out or shown the time and type of the change.

That can alert a suspect, prompt deletion, alter behaviour or compromise an operational plan.

Changing settings can also destroy evidential context by removing sessions, regenerating keys or replacing historical account information.

Assess the operational purpose. Account protection, victim safeguarding and evidence preservation may sometimes justify urgent action.

Where time allows, coordinate the change with investigators, digital specialists, providers and legal or policy advisers as appropriate.

In reports, separate pre-existing security events from those generated by the investigation.

Where the consequence is uncertain, record the risk and the reason for any decision to proceed.

What to check or do next¶

• Preserve the current settings, recovery details, linked devices, session list, account identifiers and security notifications before making changes.
• Record who authorised the action, the setting changed, exact time, device used and observed consequences.
• Preserve the source and collection method so another investigator can test the same interpretation.
• Preserve the source and collection method so another investigator can test the same interpretation.

Evidential limits¶

Do not assume that no visible alert means no provider or account record was created.