What risks exist if a device remains powered on?¶

A powered device remains an active system: local processes, networks, remote users and automatic services can continue changing both evidence and operational risk.

Change continues without physical handling¶

Messages can arrive, edits and deletions can synchronise, updates can install and logs can rotate. Sessions expire, temporary files are replaced and an unlocked screen can time out. Remote administrators, other users or malware may alter, encrypt or delete data.

In a business environment, compromise may spread or the device may continue affecting other services. Conversely, abrupt isolation or shutdown may remove monitoring and volatile evidence.

Battery depletion can cause uncontrolled shutdown and loss of memory or live encryption access. Charging may preserve power, but some ports and cables also carry data and can create new system events.

Manage and record the continuing state¶

Preserve the starting point, identify connection and lock risks, and seek specialist advice. If the device remains on, record why and which safeguards or monitoring were used.

Log material changes during preservation - new notifications, incoming messages, connection changes, screen lock and battery events - with their times. They are later activity, not part of the original state.

These risks do not create an automatic instruction to power off. The defensible choice compares them with the evidence and access that shutdown could destroy.