Skip to content
Skip to main content
First Response & Preservation Operational Explainer

Should I leave a digital device powered on?

Leave a device on only when preserving its live state is worth the managed risks of continued activity, connectivity, locking and power loss.

Continued power can preserve access

Memory, active sessions, encryption material, unsaved documents and temporary application data may survive only while the system remains running. An unlocked device can provide a time-limited opportunity for controlled specialist acquisition.

Power does not freeze the source. Messages arrive, services synchronise, logs rotate, software updates and remote users or malware may act. A screen timeout can lock the device, while battery failure can produce an uncontrolled shutdown.

Stabilise without exploring

Record the initial screen, battery, charger, connections, applications and accounts. Decide how power and remote risks will be managed, including monitoring and escalation. Connecting a charger may itself create a data connection or device event.

Server, industrial and business systems require particular care because continued operation and shutdown can both affect other users and services. Obtain relevant technical support before changing them where time permits.

Keeping a device on is not permission to browse it. Minimise interaction and record new notifications, lock events and connection changes as later activity rather than part of the original state.

Key takeaway

Preserve a live device only through an explicit plan for battery, connectivity, locking and continuing change, with exploration kept outside first response.

Reference: FRP-029First Response & Preservation