If Lucas's computer is running. Nobles may retrieve data from the computer directly via its normal interface 4 the evidence that he needs exists only in the form of volatile data

If Lucas's computer is off and Nobles needs evidence that exists only in the form of volatile data, he should turn the computer on and retrieve data directly via the computer's normal interlace.

If Lucas's computer is off. Nobles should not turn it on unless he plans to use an encryption device that can guarantee that the system's hard drive will not be accessed during startup.

If Lucas's computer is running. Nobles should perform a graceful shutdown by turning it off using the normal shutdown process