Aren't there some viruses which do more damage on reboot? And removing power cou...

Aren't there some viruses which do more damage on reboot?

And removing power could remove forensic information, if the virus was loaded exclusively in RAM.

I think air-gapping would have been a wise move, but I would have kept the server powered and running until a post-mortem could be performed.

There's nothing suggesting he actually shut the server down.