Could restarting a router destroy useful evidence?¶

Yes. Restarting a router can destroy or alter evidence held only in its live state.

Avoid this assumption: Relevant router information is always stored permanently. Many devices keep active connection tables, DHCP leases, address translations, temporary logs, VPN sessions and security alerts in volatile memory.

A restart may clear those records, reset counters, close sessions and overwrite the uptime that helps establish timing.

It may also allocate new addresses, rebuild routing tables and cause connected devices to reconnect.

Those reconnections can create fresh records that obscure the earlier network state.

Before any restart, preserve the physical device, display, lights, connected ports, open interface, warnings, uptime and visible tables.

Do not navigate through the interface merely to collect everything if specialist support is available.

Identify whether logs are stored locally, sent to another system or retained by the provider.

Where the router is part of an active incident, seek network or incident-response assistance quickly.

If restart is unavoidable for safety or service restoration, record why, who authorised it and the exact time.

Capture any visible warning that data or sessions will be lost.

After restart, record changed addresses, connections, alerts, uptime and services.

Do not present post-restart information as evidence of the earlier live state.

Preserve any visible table or alert that appears likely to clear on restart, and record whether another system may hold a duplicate or forwarded copy.

Operational takeaway¶

Assume a router restart may erase volatile connection and security evidence, and preserve the live state before any justified restart.