What should be recorded before blocking, removing or revoking access?¶

Blocking an account, removing a group member or revoking a linked device may be necessary for safety or account control.

Evidential caution: that the action can be reversed later without evidential loss.

What this means¶

Before acting, preserve the account and user identifiers, display names, profile URLs, group or conversation IDs, role, permissions, linked-device details and current access state.

Blocking or removal may change what each participant can see. It may create system messages, alter membership history, invalidate invitation links or remove a session from the current list.

Revoking a device can prevent further unauthorised access, but it may also end a live evidential session.

Where immediate safeguarding requires action, prioritise safety but document the pre-action state as fully as circumstances allow.

In reports, distinguish the original account relationship from the state created by the intervention.

Where the consequence is uncertain, record the risk and the reason for any decision to proceed.

What to check or do next¶

• Record the relevant messages, threats, contact attempts, delivery or read indicators and timestamps.
• Capture the relationship between the parties: following status, group membership, administrator roles, message-request status and any shared content.
• Record the reason, authorisation, person performing the action, exact time and resulting notifications or changes.
• Do not rely on memory after the event.
• Preserve the source and collection method so another investigator can test the same interpretation.
• Preserve the source and collection method so another investigator can test the same interpretation.