Collecting Evidence from a Running Computer
It is important to note that potential evidence may be lost or destroyed if a running computer is encountered by law enforcement and seized as part of an investigation using the historical methodology described above. (A “running computer” is defined as a computer that is already “powered on” when encountered at a crime scene.)页:
[1]