Question 1

Is it ever right just to pull the plug?

Accepted Answer

Occasionally, as a recorded judgment: classically where destruction is visibly in progress (a wipe running, mass deletion under way) and stopping it outweighs everything volatile, or where the machine is known unencrypted and volatile data is genuinely irrelevant. What is never right is the reflex version: unassessed, unrecorded, by whoever was standing closest. The question the file must answer is not "was the plug pulled?" but "who decided, on what assessment, and where is it written?" An employee's laptop is on their desk, unlocked, and they have just been suspended. What do we actually do in the next hour? Photograph the screen as found; keep the machine awake if you can do so without exploring it (a deliberate mouse-nudge regime is legitimate and should be logged); do not read, open or close anything; decide with advice whether to disconnect the network (remote-wipe risk usually says yes for a managed device); have IT verify encryption and recovery-key escrow without touching the device; and get an examiner attending the same day. The unlocked state is the most valuable evidential window this matter will ever have; spend it on nothing except preserving it.

Question 2

Does live acquisition contaminate the evidence?

Accepted Answer

It changes the machine, in small, known, documented ways: that is different from contamination. The forensic position, accepted by courts for years, is that a competent live acquisition's footprint is minimal, identified and separable from the material in issue, and the acquisition log exists to demonstrate exactly that. The evidential danger is not the footprint; it is the undocumented footprint, and the amateur one, neither of which can be separated from anything.

Question 3

The laptop is asleep. Is that on or off?

Accepted Answer

On, for the purposes that matter: memory is powered and its contents (including any mounted-volume keys) survive, but the state is fragile: batteries die, and lids and timers can tip sleep into shutdown or hibernation. Treat a sleeping machine as a ticking version of the on-and-locked or on-and-unlocked case, identify which it will wake into, and get the examiner to it before the battery makes the decision instead. Hibernation, by contrast, has already written memory to disk, which the dead-box path can recover: the states differ, and the response should too.

Question 4

We have the Bit Locker recovery key but not the user's password. Is that enough?

Accepted Answer

For the disk, generally yes: the recovery key unlocks the volume for imaging and exam in at i on without the user's cooperation, which is precisely why verifying escrow early changes the whole strategy's risk. It will not, of course, open separately protected things that live inside (password-protected files, application-level encryption, mounted-container secrets), and it says nothing about a machine whose key was never escrowed. Hence the standing rule: confirm the key position per device, in writing, before anyone relies on it. cflab. u k · e-disc ove r y. u k ©2026 Computer Forensics Lab Ltd ·cflab.uk ·e-discovery.uk ·info@cflab.uk ·+44 (0)20 7164 6915 Page 17 of 21

Question 5

Should company policy change because of any of this?

Accepted Answer

Two cheap amendments repay themselves the first time they are needed: an incident rule that powered-on devices of departing or suspended staff are left on, isolated and referred (replacing the switch-it-off training of the unencrypted era), and an IT rule that encryption recovery keys are escrowed verifiably for every corporate device, audited annually. Both convert future versions of this guide's first worked example into its second. cflab. u k · e-disc ove r y. u k ©2026 Computer Forensics Lab Ltd ·cflab.uk ·e-discovery.uk ·info@cflab.uk ·+44 (0)20 7164 6915 Page 18 of 21

Should A Computer Be Imaged While Running Or Switched Off