An actual forensics investigator will not work on a single copy of any data -- they'll make a bit-for-bit image of the hard drive in question and just work with

An actual forensics investigator will not work on a single copy of any data -- they'll make a bit-for-bit image of the hard drive in question and just work with an image.