When should a specialist make the power decision?¶

A specialist should make the power decision when the consequences of shutdown, restart or continued operation are uncertain and may materially affect the evidence.

Evidential caution: that an investigator can make a safe power decision by applying a simple rule. Different devices, encryption states, applications and operational environments create different risks.

What this means¶

Specialist support is also important where the system is a server, network appliance, industrial controller, virtual environment or business-critical platform.

A specialist may need to assess whether live memory, active sessions, running processes, encryption keys or remote connections could be lost if power is removed.

They may also need to consider the risks of leaving the system on, including remote access, synchronisation, malware activity, battery failure or continued harm.

Before contacting them, record the device as found. Capture the screen, power state, battery level, charging arrangement, network connections, open applications and visible alerts.

Where immediate danger requires action before advice is available, take the least destructive effective step and record why waiting was not reasonable.

What to check or do next¶

• Seek specialist input where the device is unlocked, encrypted, part of an active cyber incident or likely to contain volatile evidence.
• Provide a clear briefing. Explain what the device is, how it was found, what is currently visible, what has already changed and what operational risk is active.
• Do not ask for a generic instruction such as “Should I turn it off?” without context. The quality of the decision depends on the quality of the information provided.