Forensic preservation

Stopping the harm and preserving the evidence pull in opposite directions, and the most useful evidence disappears first.

Pull the plug and you lose everything in memory, which is often where the answer is. Leave it running and the attacker continues. There is no universally right call, only a decision somebody should be equipped to make quickly. Knowing in advance what you would capture, and how, is what turns it into a decision rather than a panic.