Could a live computer contain unsaved data?¶

Yes. A live computer may contain unsaved work that exists only in memory or temporary storage.

Why this matters¶

The dangerous assumption is that anything visible on screen has already been written safely to disk or cloud storage. Drafts, documents, commands, forms and messages may never have been saved.

What to record and do¶

Unsaved data may exist in word processors, spreadsheets, email drafts, chat applications, browser forms, coding tools and administrative consoles.

A crash, logout, shutdown or application closure may remove it.

Before changing the state, record what is visible, including document titles, draft indicators, unsaved markers and open forms.

Do not press save automatically. Saving may create or alter files, timestamps, versions and cloud records.

Do not close the application to test whether it prompts for saving.

Where unsaved data appears evidentially important, seek specialist advice on preserving the live state.

Photographs can record visible content, but they do not replace the underlying data or specialist acquisition.

Document any unavoidable save, discard or application closure.

Unsaved information can also exist in clipboard data, terminal input, partially completed uploads and temporary browser sessions. Record whether the application shows recovery, autosave or synchronisation indicators, but do not rely on them without verification.

A visible autosave message does not prove that every part of the current content has been preserved.

If several applications contain unsaved work, record each separately and do not assume one recovery process will preserve them all.

Operational takeaway¶

Assume visible work may be unsaved, preserve the live screen first and avoid save, close or shutdown actions without understanding their effect.