I am currently studying windows forensics and I have found that it would be advisable to image the drive while it is powered on and live. If you power it off, you likely will not be able to recover the keys. What would be the importance of these keys since I can re login into the system again?

  • 2
    What keys are you referencing? You know that there are other reasons not to shutdown when you want a clean forensic image, right?
    – schroeder
    Commented Nov 5, 2021 at 23:49

1 Answer 1


Are you referring to bitlocker/encryption keys?

If so, the device is 'unlocked' while it's on and live, but once it has been powered down, the drives are 'locked' again adding extra requirements in order to get actual usable data off the drive. Again, assuming we're talking about something like bitlocker, depending on how bitlocker is handled on the machine, there is a chance that generating a recovery key after the fact is just not feasible in general. There may be no reasonable way to create one.

If you can freely relogin to the system, I can't see this being a major concern.

Not the answer you're looking for? Browse other questions tagged .