What should I consider with a desktop computer?¶

A desktop computer may appear straightforward, but its evidence, power and connectivity may be spread across several components.

Evidential caution: that the visible tower is the whole system. The computer may depend on external drives, network storage, cloud services, multiple monitors, docking equipment or remote sessions.

What this means¶

Consider whether the desktop is part of a wider organisational network. It may be remotely managed, connected to shared storage or used to access systems that hold the real evidence elsewhere.

Document every action, including cable disconnection, movement, shutdown and transfer.

What to check or do next¶

• Record the full setup before touching anything. Photograph the screen, computer case, cables, power sources, network connections, external storage and nearby peripherals.
• Note whether the computer is powered on, locked or unlocked, and what applications, accounts or warnings are visible.
• Do not close applications or disconnect external drives to simplify the scene. They may contain open files, active sessions or relevant data.
• Record asset tags, serial numbers, hostnames and visible account identifiers.
• If the system is live, encrypted, remotely accessed or involved in an active cyber incident, seek specialist support before shutdown or isolation.

Evidential limits¶

Check for secondary power sources such as an uninterruptible power supply. Pulling the wall plug may not turn the system off, and removing the wrong cable may affect other equipment.

Where seizure is being considered, remember that the monitor, keyboard and mouse may not contain the evidence, while attached storage or security keys may be critical.