For anything with more than one socket, you just plug in a second cable into a free socket, once the phases are synced up unplug the extension cord or cut the socket free.
For singular sockets straight into the wall, unscrew, clip on connectors with a V shaped knife and same as above.
Although when I was working we usually would take images onsite before even considering moving the devices.
It's definitely not bullet proof but I've set up my laptop to lock when Ethernet or the monitor is unplugged or any new USB device is plugged in. This stops most but not all live imaging.
Might as well go all in and epoxy the ram sticks/dimm slot assembly.
Putting epoxy around the top and bottom edges (where the retention clips are) and the right edge (where the contacts are) should make it extremely difficult to dislodge, but not impact the thermal performance of the chips (the black rectangles).
I've noticed many lower end have one soldered and one removable. Drives me crazy because then you end up with more RAM but less performance, so have to choose which hit is worse.
nah, that applies to many mid to high range laptops as well, eg. 14" thinkpads has had 1 soldered 1 removable dimm for years now.
Basically the internal battery is used as a buffer for power peaks. So the laptop can use more than the adaptor can provide for a short time. If it didn't throttle it would become unstable.
It's not as though you tampered with the device after the confiscation. Intent is also hard to prove on such a thing. I didn't want my dimms to fall out at any time if the machine was dropped is pretty good plausible deniability.