Could shutting down create new records?¶

Yes. An orderly shutdown is a sequence of system and application activity that can write logs, save state, update timestamps, close sessions and synchronise data.

Shutdown changes the source before it stops¶

Applications may save drafts and caches, close files or record recent activity. Security software can log the shutdown, while cloud services may send final updates. The process also removes memory, terminates authenticated sessions and can re-engage encryption.

Sudden power removal creates a different trace. It may avoid some orderly writes, but can interrupt storage operations, corrupt data and destroy live evidence immediately. Neither method is evidentially neutral or universally preferable.

Record shutdown as an event¶

Before intervention, capture the screen, open applications, accounts, network state, power and warnings. Identify why shutdown was chosen over continued operation and which advice informed the decision.

Record the operator, exact time and method, any prompts or visible sequence, and whether the device actually powered off. On an encrypted, unlocked, critical or incident-affected system, seek specialist support before acting where practicable.

Later examination should be able to distinguish records created by the shutdown from activity already present. Treating the transition transparently is stronger than describing the powered-off device as an unchanged exhibit.