It can still be useful when they don't have physical access to make an image, for instance when the system in question is being remotely accessed via ssh.
> Also, note that destructing or concealing evidence that is relevant to a court case or legal investigation is a criminal offense in many jurisdictions.
It can still be useful when there's no court case or legal investigation. For instance, when you're being illegally threatened to reveal your password.
> It can still be useful when they don't have physical access to make an image, for instance when the system in question is being remotely accessed via ssh.
Bear in mind that law enforcement generally has the ability to go get those too.
> It can still be useful when there's no court case or legal investigation. For instance, when you're being illegally threatened to reveal your password.
You're absolutely right! One caveat worth considering is that this might not be a typical security threat that most people are likely to face.
It can still be useful when they don't have physical access to make an image, for instance when the system in question is being remotely accessed via ssh.
> Also, note that destructing or concealing evidence that is relevant to a court case or legal investigation is a criminal offense in many jurisdictions.
It can still be useful when there's no court case or legal investigation. For instance, when you're being illegally threatened to reveal your password.