Aren't there some viruses which do more damage on reboot? And removing power could remove forensic information, if the virus was loaded exclusively in RAM. I

Aren't there some viruses which do more damage on reboot? And removing power could remove forensic information, if the virus was loaded exclusively in RAM. I think air-gapping would have been a wise move, but I would have kept the server powered and running until a post-mortem could be performed.