I can speak to this one.... I am in "big tech" one job i had was in forensic collection of digital data. There are an agreed upon set of rules for forensically copying non volitile (doesn't disappear) data when i computer is powered down. A forensic collection is done on all drives. Assuming a few things. If the machines used "spinning drives" even if you go in and delete what is on them you just delete the machines "reference" to those files. The files still exist. Taking a forensic...bit for bit copy of the drive keeps those "deleted" files as well as files still referenceable in the drives tables. You do this to preserve the data on the original machine...no changes...just a copy and you can take that and take as long as you need to analyze it. I have produced data for the DOJ, Law firms, and states. It is pretty simple really, they make devices designed to do just this. It doesn't take a lot of time at all and you protect the original source of the data doing it this way.