After securing a smart device that is on but unlocked, what is the next immediate step?

The next immediate step after securing a smart device that is on but unlocked is to put it into airplane mode. This action is crucial as it prevents any incoming communications, such as calls or messages, that could compromise the integrity of the evidence. By engaging airplane mode, it essentially isolates the device from external influences while you assess it further. This can help protect the data from being altered or deleted by incoming signals or communications.

While locking the device might seem like a logical step, doing so can potentially alter the state of the device and could lead to the loss of valuable data that may be accessible while it remains unlocked. Documenting evidence is important but comes after ensuring the device is in a secure state. Disabling the password would not be advisable as it could lead to unauthorized access or modification of the device’s data. Thus, putting the device into airplane mode is the most appropriate next step to protect the integrity of the evidence.