Also first thing to do is switch it off and image the drive