Is pulling the power cable the same as shutting down?¶

No. Pulling the power cable and performing an orderly shutdown can have very different effects.

Evidential caution: that both actions simply turn the device off. An orderly shutdown allows the operating system and applications to close, save data and write logs. Pulling power interrupts activity immediately.

What this means¶

Removing power may preserve some live state from further software activity, but it can also destroy volatile evidence, corrupt files, interrupt storage writes and damage running services.

An orderly shutdown may be safer for system integrity, but it may also terminate sessions, save application state, create shutdown records and re-enable encryption.

The device type matters. A desktop computer, server, router, storage appliance and embedded system may respond differently to sudden power loss. A laptop may continue running on battery after the cable is removed.

Before altering power, record what is connected and whether a battery, uninterruptible power supply or secondary power source is present.

Where urgent safety or operational necessity requires immediate power removal, record why and use the least destructive effective action available.

Document the time, method, person responsible and any visible result, including whether the device remained on.

What to check or do next¶

• Do not remove cables simply because the device appears suspicious or unfamiliar. In a business or network environment, one power action may affect multiple users, services or evidential systems.
• If the correct method is unclear, stop and obtain specialist advice. Improvised power decisions can permanently reduce the evidential value of the system.