What should you do if you arrive at a scene and the computer is turned off, but the monitor is on?

When arriving at a scene where the computer is turned off but the monitor is on, the best course of action is to seize the computer as is, preserving the state of the device as much as possible. This approach is crucial because turning on the computer can alter its state, potentially compromising important evidence.

Computers often have volatile data that could be lost if the machine is booted up or improperly handled. For example, if there are any unsaved documents, cached data, or memory that holds critical information, powering on the computer may overwrite or erase this data. By taking the computer in its current state, you maintain the integrity of the evidence, allowing forensic analysts to perform a proper evaluation later.

Other options, such as turning the computer on or calling for technical assistance, risk modifying or losing data that could be essential for the investigation. Unplugging the monitor does not address the critical piece of evidence—the computer itself—and might inadvertently cause disruptions or further data loss. Therefore, preserving the current state of the system by seizing it without powering it on is the most appropriate action to take in this scenario.