What should I consider with a desktop computer?¶

Treat a desktop as a connected system whose display, storage, power and network relationships may extend beyond the visible computer case.

Map the complete setup¶

Photograph the screen, case, ports, cables, monitors, external storage, security keys and peripherals before movement. Preserve asset tags, serial numbers, hostnames, accounts and visible application state.

Record whether the system is on, locked, remotely accessed or showing warnings. Do not close applications or detach storage to simplify the scene; open files, mounted volumes and authenticated sessions may depend on them.

Check externally for uninterruptible or secondary power. Pulling one wall plug may leave the machine running, while removing the wrong cable can interrupt other equipment.

The evidence may reside elsewhere¶

An organisational desktop may access shared storage, cloud applications, virtual desktops or remotely hosted systems. The monitor and keyboard may contain little data, while attached storage, network services and authentication devices can be central.

Where the system is encrypted, remotely managed or part of an active incident, preserve the visible state and seek support before shutdown or isolation. Record every cable change, movement and transfer so the later acquisition can reconstruct the system as encountered.