First Response & Preservation Technical Explainer

Could a live computer contain unsaved data?¶

Yes. A live computer can display work that has not yet reached its normal file, cloud account or message store.

The useful point is not simply that “RAM is volatile”. It is that the version visible on screen may be the only version containing the latest words, selections, command output or upload state.

Recognise the signs¶

Unsaved or partly saved material can appear in ordinary places:

What is visible	What may still be temporary	What to record
A word-processing document with an asterisk or Unsaved label	Recent edits not written to the normal file	Title, visible text, indicator, file location and application
A browser form or webmail draft	Text held in the page or a provider draft that has not synchronised	Service, account, URL, draft status and visible content
A command window	Output, variables or a partly typed command held only in the session	Prompt, user, host, path, command, output and cursor position
A file transfer or upload	Data staged locally or only partly received by the remote service	File name, source, destination, percentage, time and error state

Autosave and synchronisation indicators are useful, but they do not prove that the exact visible version has reached durable storage. The copy on disk, the cloud version and the screen can be at different stages.

Saving is also an intervention¶

Pressing Save can preserve content, but it can also create or overwrite a file, update timestamps, add a new cloud version and generate provider or audit events. Choosing Discard may remove the material. Closing the application may present another prompt or end the chance to recover it.

Application stateVisible work in progressText, command output, form values or a transfer may exist only in the live session.

Save or syncState is written elsewhereThe action can create a file, version, timestamp or provider event.

Later evidenceStored copy and audit historyThese may preserve the result without showing every part of the earlier live state.

Preserve the position before choosing¶

Record the whole live workspace, including the application, document or draft title, account, location, save indicator, visible content, time and any active upload or synchronisation message. A photograph preserves what was displayed; it does not acquire the editable content or hidden application state.

If the unsaved material is important, seek specialist advice before saving, closing, logging out or shutting down. Treat applications separately: recovering a word-processing draft does not preserve a browser form or a command session.

Where the latest state may exist only in the running system, consider whether evidence in memory needs specialist preservation.