> It can still be useful when they don't have physical access to make an image, for instance when the system in question is being remotely accessed via ssh. Be

> It can still be useful when they don't have physical access to make an image, for instance when the system in question is being remotely accessed via ssh. Bear in mind that law enforcement generally has the ability to go get those too. > It can still be useful when there's no court case or legal investigation. For instance, when you're being illegally threatened to reveal your password. You're absolutely right! One caveat worth considering is that this might not be a typical security threat that most people are likely to face.