Evidential scenario
A device has surfaced and must be preserved
The priority is to maintain its present evidential state, record custody and avoid well-intentioned actions that alter or remotely expose the data.
Questions to resolve
Establish the fact base.
Q1
Is it powered, unlocked and network-connected?
Q2
Who has lawful authority?
Q3
Is remote wiping a credible risk?
Immediate actions
Preserve the available routes.
A1
Photograph and document the current state
A2
Limit handling and record custody
A3
Obtain case-specific isolation advice
A4
Secure known credentials separately
Interpretation risks
Avoid premature conclusions.
Power loss closing an accessible state
Remote alteration while online
Repeated passcode attempts or casual browsing
Confidential case review
