If an activated computer is a part of the criminal investigation, it should be immediately turned off to prevent any software from destroying the data on the hard drive.

Question

Quizplus · Accepted Answer

Turning off a computer that is part of a criminal investigation can potentially result in the loss of volatile data (data stored in memory that is lost when the power is turned off) and may also affect evidence that could be found in running processes or network connections. Proper forensic procedures involve capturing this data before any power changes are made.

If an Activated Computer Is a Part of the Criminal