What is the recommended practice when collecting evidence from a device that is powered on?

The recommended practice when collecting evidence from a device that is powered on is often referred to as On-State Collection. This approach allows law enforcement officers to gather data that is actively being processed or used by the device, which may provide crucial information that could be lost if the device is powered down.

During On-State Collection, investigators can take steps to ensure that the data remains intact while they gather information, which may involve securing the device at the moment of collection, creating a digital copy of the data, or using specialized tools that can extract the necessary information without altering the state of the device. The goal is to preserve the integrity of the evidence while capturing the full context of the digital activity that was occurring within the device, thus providing a comprehensive view of potential evidence related to a case.

This practice contrasts with immediate shutdown protocols, which would typically involve turning off the device, potentially leading to data loss or corruption. Maintaining session integrity and continuous data monitoring might be involved in certain specialized scenarios but do not specifically address the initial collection process from a device that remains powered on.