First responder checklist

Keeps the order of SOP-01 in front of the responder under pressure, and records what was done.

Fill this in your browser and export it. A draft is saved only in this browser; nothing is sent anywhere.

A box that cannot be ticked is a deviation; write why in the notes with the time.
Export or print the checklist at hand-over; it becomes part of the intake record.

Deployment

Case / operation reference

Responder (name, role)

Arrival at sceneUTC, ISO 8601 (YYYY-MM-DDTHH:MM:SSZ)

Reference clock source and offset

Preparation

Authority read: what may be seized, on-site imaging allowed, passwords may be requested
Kit checked: camera, labels, seals, anti-static and shielded bags, power bank, write blocker, sterile media, gloves, forms
Destination for seized items agreed

Scene

Each device

Powered-on computer

Not switched off; screen photographed with date, time and zone
Woken with mouse movement or Shift, not Enter or power
Destructive process check: wiping, encryption in progress → power cut at device if running
Encryption, network and cloud indicators checked and noted
Live collection decision recorded with reason, time and decider
Shutdown performed by removing power at the device, time recorded

Powered-off computer

Mobile device

If on: kept on, screen and displayed time photographed
Isolated: airplane mode with Wi-Fi and Bluetooth off, or shielded bag with power source inside
If off: left off
IMEI, SIM / ICCID and memory card recorded separately
Charger and cables seized

Packaging and custody

Anti-static bags for media, shielded bags for wireless devices
Tamper-evident seals signed and dated; seal numbers recorded
Paperwork kept separate from devices
Chain of custody form started for every item
Transport protected from shock, heat, moisture and magnetic fields; never left unattended

Notes and deviations

Export integrity hash (SHA-256 of the .txt export): —