# Should we unplug an infected computer or switch it off?

Unplug it from the network, but leave it switched on unless you have a reason not to. Pulling the cable and turning off Wi-Fi stops the attacker controlling it and stops it spreading, while memory keeps evidence that disappears at shutdown: running programs, network connections, sometimes encryption keys that help recovery. Switching off is the right choice when you cannot isolate the machine any other way and damage is spreading fast, or when specialists ask for it. Do not log in as an administrator to look around, run cleaning tools or reboot before taking advice, because each step changes the evidence. Note the time and what you did. If the machine is a server others depend on, isolate it at the switch or firewall rather than pulling cables at random. A network sensor such as NetSenX keeps the record of what the machine did before you disconnected it.

FAQ: [Incident response](https://netsenx.com/en/faq/incident) · https://netsenx.com/en/faq/should-we-unplug-or-switch-off-an-infected-computer

## Read next

- https://netsenx.com/en/detect-ransomware-on-the-network
- https://netsenx.com/en/nis2-incident-reporting-deadlines

## Related questions

- [What should we avoid doing during a cyber incident?](https://netsenx.com/en/faq/what-not-to-do-during-a-cyber-incident)
- [How do we find patient zero, the first machine the attacker compromised?](https://netsenx.com/en/faq/how-to-find-patient-zero)
- [What is a forensic image, and when do we need one?](https://netsenx.com/en/faq/what-is-a-forensic-image)
- [What is chain of custody for digital evidence?](https://netsenx.com/en/faq/what-is-chain-of-custody-for-digital-evidence)
- [How do we preserve logs before they are overwritten?](https://netsenx.com/en/faq/how-to-preserve-logs-before-they-are-overwritten)