First Response & Preservation Operational Explainer

When should a specialist make the power decision?¶

Ask for specialist ownership when changing the power state could materially alter access, volatile evidence, encryption, live services or an active incident and you cannot confidently predict the effect.

The point is not that specialists must decide every shutdown. It is that some devices carry consequences you cannot safely see from the outside.

The practical test

If power-off, restart or continued power could close a valuable evidence route or disrupt a wider system, escalate before changing state where time allows.

Some devices lose more than power¶

A live laptop may currently be:

unlocked;
holding encryption keys in memory;
connected to a cloud session;
running remote access;
showing transient application state; or
attached to a network that is producing useful evidence.

A server, router, virtual host, industrial controller or business-critical appliance may also support other users or services.

Ordinary low-risk devicePower change is predictableNo live access, no obvious dependency and no critical service impact.

Higher-risk live systemPower change may close evidence or servicesUnlocked state, encryption, volatile processes, active incident or wider dependency.

Give the specialist something useful to decide from¶

“Should I turn it off?” is not enough.

Provide:

device type and apparent role;
condition found;
visible screen;
whether it is locked or unlocked;
mains/battery state;
network and cable connections;
open applications or warnings;
known prior handling;
operational objective; and
how quickly the situation may change.

A simple handover might be:

Power-decision briefing

Device: Windows laptopState: unlockedPower: mains connected · battery 42%Network: Wi-Fi connectedVisible: cloud admin portal + terminal windowRisk: screen may lock automatically

That lets the specialist make a decision about the actual state rather than a generic device category.

Preserve the decision opportunity while advice is sought¶

Record the starting state before anything changes.

If the battery is low, the screen may lock, harm is continuing or an active system is unstable, make the time pressure explicit.

What is device isolation? covers the separate question of controlling communications without automatically removing power.

If immediate danger makes waiting unreasonable, use the least destructive effective action within your authority and competence, then record why specialist advice could not arrive first.

The practical point is: escalate the power decision when the consequence is uncertain and important. Give the specialist the live state, the operational objective and the deadline.