Suppose, you are a detective for the local police, you have some training in computer forensics. The primary suspect in a murder investigation works at a large local firm. He is reported to have two computers at work in addition to one at home. His company has issued him a cellphone for business use, but you do not know if this is the only cellphone he has or uses. You are the first responder to both scenes.

With three computers, the chances are pretty good that at least one of them will be turned on and one of them will be turned off. What are the risks of turning a computer on or off at the scene? Should you take a disk image at the scene?