Why would you not turn off a router before examining it for evidence?

Why would you not turn off a router before examining it for evidence?

• A. It would void warranty
• B. You may destroy evidence
• C. It will speed up the analysis
• D. It will delete logs

Answer: (B)

Preserving volatile evidence is essential in digital forensics; powering down a router can alter or erase data that only exists while the device is powered. Routers store dynamic information in RAM—active routing tables, current network sessions, and recently generated logs—that hasn’t necessarily been written to non-volatile storage yet. If you turn it off, that volatile data can be lost or corrupted, and the sequence of events can be changed, which jeopardizes the integrity of the investigation. Some logs may survive on flash, but rebooting or a power-down can reset counters and timing information, making it harder to reconstruct what happened. So the best approach is to avoid powering off and instead preserve the device’s state for proper acquisition and analysis. The other reasons listed are less central to evidence preservation—warranty, speed, or logs alone—whereas the core concern is preventing destruction or alteration of evidence by changing the device’s power state.

Preserving volatile evidence is essential in digital forensics; powering down a router can alter or erase data that only exists while the device is powered. Routers store dynamic information in RAM—active routing tables, current network sessions, and recently generated logs—that hasn’t necessarily been written to non-volatile storage yet. If you turn it off, that volatile data can be lost or corrupted, and the sequence of events can be changed, which jeopardizes the integrity of the investigation. Some logs may survive on flash, but rebooting or a power-down can reset counters and timing information, making it harder to reconstruct what happened. So the best approach is to avoid powering off and instead preserve the device’s state for proper acquisition and analysis. The other reasons listed are less central to evidence preservation—warranty, speed, or logs alone—whereas the core concern is preventing destruction or alteration of evidence by changing the device’s power state.