Well probably it has been done, back on the 6 we analysed some streams / recordings, there were 2 dudes with gas masks and military uniform going in with the crowd and heading straight to Pelosi office, then later a bunch of guys was captured walking the stairs down quickly with what looked like a SPECs grip (was explain by someone in the field, they were like lined in a row keeping each other with a hand like a grip on the backpack of the one in front and shielding with the other arm), if those were really spec ops, be sure that their bag was already jammed and isolated, then they probably did a full cold clone of everything (RAM with pagings+HW Caches+data), write protected the drives and extracted stuffs (write protection is to ensure CRC integrity on the files for the courts, this way you can proof that the data has not been tampered in any way, as the checksum matches the original file