Should I switch a digital device off?¶

Whether to switch a digital device off depends on what evidence may be live, what risks remain active and what may happen when power is removed.

Evidential caution: that powering off always preserves evidence. It may stop remote access or ongoing change, but it may also destroy volatile memory, close live sessions, re-enable encryption and make an unlocked device inaccessible.

What this means¶

Before making the decision, record the device as found. Capture the screen, power state, battery level, network connections, open applications, logged-in accounts and any visible alerts or activity.

Consider what may be lost. A powered-on device may contain unsaved documents, active chat sessions, encryption keys, running processes, network connections or evidence held only in memory.

Consider what may continue if it stays on. The device may receive new messages, synchronise deletions, update software, be remotely accessed or lose battery power unexpectedly.

Avoid navigating through menus simply to perform an orderly shutdown unless the likely effect is understood. A normal shutdown can create logs, save application state and close sessions. Pulling power may have different consequences.

Where the device is unlocked, encrypted, part of an active incident or connected to critical systems, obtain specialist advice wherever practicable.

Document exactly who made the decision, when, what method was used and what changed.

What to check or do next¶

• Do not apply a single rule to every device. A mobile phone, laptop, desktop, server, router and embedded system may react differently to shutdown or sudden power loss.
• If immediate safety or operational necessity requires power removal, use the least destructive effective action and record why it could not wait.