"useful to seize the machine powered up at least to capture images of the screen"
Not only, evidently, although it was important to arrest him on the spot, as he had the chat open.
"On the laptop we found an enormous amount of evidence, said Der-Yeghiayan" - it would be interesting to know how they obtained that.
Today you don't have to care only about BIOS/UEFI password and Windows EFS, but other types of disk encryption. You'll have to weight if is more important to gather data from a powered on machine while data are still accessible, knowing that it could be challenged in court, or risk to lose all if the disk is strongly encrypted. Evidently, you have to adapt to new criminal uses of technology.
Biting the hand that feeds IT
