Could shutting down create new records?¶

Yes. Shutting down a digital device can itself create new records and alter the state you are trying to preserve.

Evidential caution: that an orderly shutdown simply stops the device without changing anything. In reality, the operating system and applications may save settings, close files, write logs, update timestamps and record that the shutdown occurred.

What this means¶

Applications may store recent activity, save drafts, write cache data or close network sessions. Security tools may record the shutdown event, and cloud-connected software may synchronise final changes before power is removed.

A normal shutdown may also terminate live sessions, remove volatile memory and cause encryption to re-engage. The device may then require stronger authentication on restart.

Sudden power removal creates a different evidential effect. It may avoid some orderly writes, but it can also corrupt data, interrupt storage operations and remove evidence held only in memory.

Before any shutdown, record the screen, open applications, logged-in accounts, network connections, power state and any visible warnings.

Where the device is unlocked, encrypted, part of an active incident or connected to critical systems, seek specialist advice before changing power state.

What to check or do next¶

• If shutdown is necessary, record the exact method used, the time, who carried it out and any visible messages or changes.

Evidential limits¶

Do not assume one method is always better. The correct decision depends on the device, what is running, the likely evidence and the operational risks of leaving it powered on.