When collecting a desktop computer system from a crime scene that is powered on and operating what is the correct way of shutting the system down?

Question

Options

• AShutdown using the computers operating system.
• BReboot and use SAFEMODE to shutdown.
• CUnplug computer system from the power source.
• DNone of the above

• A
  3% (1)
• B
  13% (4)
• C
  77% (23)
• D
  7% (2)

Explanation

Unplugging the computer directly from the power source (C) preserves the integrity of digital evidence by preventing the operating system from writing data, clearing logs, or running shutdown scripts that could alter or destroy volatile and stored evidence.

Why the distractors are wrong:

• A is incorrect because a normal OS shutdown triggers processes that can overwrite temporary files, clear the pagefile, update timestamps, and run scripts - all of which modify potential evidence.
• B is wrong for the same core reason: rebooting in any mode (including Safe Mode) allows the OS to execute processes and write to disk before halting, contaminating the evidence chain.
• D is incorrect because C is a valid, standard practice in digital forensics.

Memory tip: Think "pull the plug, preserve the evidence." In forensics, the goal is to freeze the system state - a controlled shutdown thaws it first, giving the OS time to tamper with the very data you're trying to collect. The exception to this rule is for servers or RAID systems, where a hard pull can cause data corruption - but for a standard desktop, pulling the power is the accepted method.

No community discussion yet for this question.