
292 䡲 Cyber Forensics Field Manual, Second Edition
Shutting the computer down by the correct method is critical if certain data is normally stored
only in memory, to be committed back to disk when the machine is powered off . Shutting down
computers, which do not normally store data in memory (such as Windows XP) by the usual
method will result in possible changes to the data on the hard drive.
It is imperative, and worth repeating again, it is imperative, that at this point in the investiga-
tion you MUST NOT alter the condition of any electronic devices: If it is off , leave it off . If it is
on, leave it on.
Once power to the machine has been ...