At a crime scene, if a computer is powered off, should you turn it on?

At a crime scene, if a computer is powered off, should you turn it on?

• A. True
• B. False
• C. Sometimes
• D. Not sure

Answer: (B)

Powering on a computer that is already at a crime scene can alter or destroy evidence. When a machine is turned on, data can be written to disks, timestamps can change, memory contents can be overwritten, and encryption keys or logs may be activated, all of which compromises the ability to reconstruct what happened. The proper approach is to preserve the device in its current state, photograph and document it, secure it from tampering, and arrange for a proper forensic imaging by qualified personnel using write-blockers in a controlled environment. Turning it on is avoided unless a trained examiner determines it’s necessary and can be done without jeopardizing the evidence.

Powering on a computer that is already at a crime scene can alter or destroy evidence. When a machine is turned on, data can be written to disks, timestamps can change, memory contents can be overwritten, and encryption keys or logs may be activated, all of which compromises the ability to reconstruct what happened. The proper approach is to preserve the device in its current state, photograph and document it, secure it from tampering, and arrange for a proper forensic imaging by qualified personnel using write-blockers in a controlled environment. Turning it on is avoided unless a trained examiner determines it’s necessary and can be done without jeopardizing the evidence.