The legal angle sounds logical. As this was a forensic audit afterall. If the machines were connected to the local network LAN (also maybe mobile WAN but thats another issue) then if you want to forensically trace all aspects of the election the network equipment used needs to be inspected. Wires, routers, switches, wireless repeaters, firewalls.

Anything and everything to see if there was an intrusion of any kind that would affect that network the machines were connected to.