Suppose an attacker gained physical access to a device (a smartphone, for example). Would be be harder for the attacker to perform malicious actions on the phone when the phone is shut down?
I’m asking the question because I’m aware of several points:
Physically changing some kinds of devices is hard for attackers with average ability. For example, while it would be easy to attach a hardware keylogger to a keyboard connected to a large desktop computer, doing so on a phone without being discovered by the user is considerably harder (e.g. weight change, space constraints, abnormal wear and tear). Because of these, attackers may look for other attack vectors.
For a running system, it’s hard to restore the state of the system after altering it physically. For example, manipulating the system’s RAM may lead to a shutdown. If the admins are aware of such an abnormal behaviour next morning, they may perform hardware checks before any hardware keylogger logs their admin passwords. For a phone, the lock screen may change after rebooting (e.g. fingerprint unlock disabled, unread notifications disappeared).
For a running system it would be easier to run code on it, for example, inserting removable devices or exploiting vulnerabilities in the lock screen. For a system with above-average security, attackers may not be able to run code easily (e.g. locked servers, checking for kernel signature during booting etc).
I would appreciate it if you notice some other points/mitigations.