Should I leave a digital device powered on?¶

Leaving a digital device powered on may preserve a live state, but it can also allow the evidence to continue changing.

Evidential caution: that doing nothing means nothing changes. A powered-on device may continue synchronising, receiving messages, updating logs, communicating with remote users or running malicious processes.

What this means¶

Consider what continued power may preserve. The device may retain active sessions, encryption keys, unsaved data, memory-resident evidence and access to content that could become unavailable after shutdown.

Consider what continued power may risk. The device may be remotely wiped, locked, updated, altered by another user or lose power unexpectedly.

Battery management may become urgent, but connecting a charger is not always neutral. Some ports and cables carry data as well as power, and the device may react to the connection.

Where the correct response is uncertain, stabilise the scene, prevent unnecessary handling and obtain specialist advice.

What to check or do next¶

• Record the device as found before deciding. Capture whether it is unlocked or locked, the visible screen, battery level, charging state, network connectivity, open applications and logged-in accounts.
• If the device is part of a server, network, industrial or business environment, leaving it on may preserve continuity but also allow ongoing compromise or harm. Specialist input may be essential.
• Do not keep interacting simply because the device remains on. Preservation is not permission to search. Record what is visible and minimise further change.
• If a decision is made to leave the device powered on, document why, how battery and connectivity risks were managed and what monitoring or safeguards were used.