During the investigation, if the suspect is present, the prosecution would prevent any vicinity of him with the system. Especially if the suspect has superior training in computing, he may deliberately alter the data on his computer without investigators could seize it. Suspect’s computer may contain some commands that can cause loss of data, commands that it is possible to be masked under the name of common commands of the operating system used.
If the suspect insists to assist investigators in the process of closing the computer or lifting process system components, they may ask the suspect to describe operations that it wants to run, and even write them on paper. Investigators will not follow the suspect directions, but will deliver to expert carrying out analysis of samples. They will be aware of the possible pitfalls introduced in this way by the suspect.