9. The ON/OFF Switch, cont.

• Shutting the system normally cleares some evidence such as memory swap file during the normal shutdown process.

• Most law enforcement training programs recommend turning all computers off immediately in all situations:

  • Unplug the power cable from the computer (not from the wall, not using the power switch.)

  • Extra caution is needed when computer's power switch may set off explosives to destroy evidence.

• In most situations cutting the power off on the computer may mean that

  • A small amount of evidence in memory will be unrecoverable...

    ...but -- the integrity of the evidence already present on disks will be retained.