Could restarting a router destroy useful evidence?¶
Yes. DHCP leases, translations, connections, VPN sessions, counters, alerts and temporary logs may exist only in live memory.
Restart replaces the network state¶
It resets uptime, closes sessions, rebuilds routes and can assign new addresses. Reconnecting clients then create fresh records that obscure earlier associations.
Preserve device, display, ports, warnings, uptime and visible tables. Identify whether another system or provider receives forwarded logs.
Distinguish the replacement state¶
If service or safety requires restart, record reason, authority, exact time and data-loss warnings. Capture addresses, clients and alerts afterwards separately.
Post-restart observations cannot establish the earlier live state without preserved records.
Key takeaway
Assume restart erases and rebuilds volatile network evidence; preserve live tables and timing before the transition.
