Normal shutdown

A normal shutdown should, in theory, leave you with a clean filesystem. This, of course, assumes that this is possible with a system infected with malware. I have found that some rootkits prevent a normal shutdown. The biggest reason not to use a normal shutdown is that some malware might clean up after itself, destroy evidence, or even worse destroy other information on the system. With the modern journaling filesystems likely to be found on the subject system, a clean filesystem is not as crucial as it was many years ago.