What risks exist if a device remains powered on?¶

A powered-on device may preserve useful live evidence, but it also remains capable of changing.

Evidential caution: that leaving the device untouched preserves it. Background processes, remote users, cloud services and ordinary system activity may continue without anyone physically touching the device.

What this means¶

The device may receive messages, synchronise edits or deletions, install updates, rotate logs, lock automatically or lose battery power.

Remote access may remain active. Another user, administrator, offender or service provider may alter, delete or encrypt data.

Malware may continue running, communicating or destroying evidence. In a business environment, the device may also continue affecting other systems.

New events may overwrite older volatile records. Logs can roll over, temporary files can be replaced and active sessions can expire.

An unlocked device may lock when the screen times out. A low battery may cause an uncontrolled shutdown, which can remove memory-resident evidence and re-enable encryption.

Keeping the device charged may help preserve power, but charging cables and ports may also support data connections.

What to check or do next¶

• Where possible, record the current state, consider isolation options, manage battery risk and obtain specialist advice.
• If the device remains powered on, document why and note any changes that occur during preservation, including new notifications, lock events, connection changes or incoming activity.

Evidential limits¶

The risk does not mean the device should always be switched off. Powering down may destroy equally important evidence. The decision is a balance, not a universal rule.