@emptywheel @matthew_d_green After a cursory review of the whistleblower transcript (item 20), there is no reason I can see why you'd do this. It's honestly a bit perplexing to me. But this drive seems to have been mishandled at every turn - at least this is consistent...

Alternate theory: it's inarticulate wording?

@malwarejake @emptywheel @matthew_d_green It seems like the last thing you'd want to do is boot it. I'd use something like a gparted boot disk or Puppy Linux to boot from usb and image the whole drive that way.

i assume there are more professional equivalent tools.

@emptywheel @malwarejake @RandomNunesParody @matthew_d_green
Every boot adds to the log files that forensic people should be looking at (instead of dick pics). Once booted, computers periodically "rotate" log files – meaning they move current logs to a different filename daily or weekly or monthly, keep N old versions, and purge anything older.

In short, booting will modify forensic data, and depending on timing can destroy forensic data.