I suppose you might want to first rule out a break-in, and if there is one, recover evidence that won't survive a reboot.