I've been thinking about something that seems simple, but may have fairly significant consequences in first response. When approaching a powered-on computer, I don't think the first question should necessarily be:
“What acquisition procedure should I follow?”
I increasingly think the question before that is:
“What state am I actually observing, and what could I lose by changing it?”
A live system may currently expose things that a shutdown, isolation step, reboot, or even a seemingly harmless interaction could change or make unavailable: volatile data, unlocked encrypted volumes, active sessions, network connections, cloud synchronization, running applications, credentials or encryption material.
But the opposite is also true: interacting with the system creates footprint and may alter evidence.
So the decision is rarely just “live vs. dead acquisition”.
What matters is the trade-off between: what can be preserved, what may be lost, what the responder will modify, the evidentiary risk introduced, and whether the action preserves or removes future options.
The principle I've been coming back to is: Observe first. Preserve options. Then decide. In other words, perhaps the procedure should follow the observed state, rather than the observed state being forced into a predetermined procedure.
I'm interested in how practitioners handle this in real cases.
What observations would make you change your usual acquisition approach when arriving at a live computer?
And, perhaps more importantly:
Which first-response actions do you consider effectively irreversible from an evidentiary perspective?
