What should I do if the device is displaying notifications?¶

Record notifications exactly as displayed and do not open or clear them casually. They are volatile leads, not complete proof of the underlying event or the user's knowledge.

Preserve the visible context¶

Capture the device state, displayed time, app, account or sender label, wording, order and other visible indicators. A notification may represent a message, missed call, security event or automated background activity. Photograph the whole screen where authorised before it changes.

Interpret the alert cautiously¶

Notifications can arrive late, repeat, synchronise from another device or remain after source content changes. Tapping may mark content read, acknowledge delivery, launch an app, synchronise data or expose unrelated material. Clearing removes the visible state.

Corroborate with app databases, provider records, linked devices and cloud accounts. A remote-wipe alert, active communication or low-battery warning may create urgency, but still requires a recorded, proportionate response.