Printable checklist

Preserve the available evidence

Proportionate first steps while an authorised collection plan is agreed. There is no universal instruction to switch off devices or disconnect every account.

Original content baseline 6 November 2026 · Content revision 0.3

Retain original messages, files, screenshots and existing exports.
Record the service, account type, devices and relevant custodians.
Note relevant dates, timezones, deletion, migration and compromise history.
Avoid unnecessary cleanup, compaction, repair, conversion or migration.
Do not restore over the only surviving copy.
Coordinate preservation with authorised containment and account protection.
Record necessary account or system changes and who made them.
Agree authority, scope and a suitable transfer method before sending evidence.

If an account is compromised, coordinate evidence preservation with authorised containment and account protection. Record necessary actions. This site does not offer continuous emergency monitoring.

Make an enquiry

Tell us what needs to be established.