We have a legal case where we need to take a clone of a laptop hard drive without making any changes to that hard drive.
Therefore it must be like when we are finished with the original hard drive, it must be in the EXACT same state that it was before the clone operation as if it has not even been started.
My initial assumption is this is acheiveable but I would like a second opinion.
My thoughts are we proceed as so:
1) Remote the hard drive from laptop and place into external caddy.
2) Find a suitable hard drive image program (suggestions welcome) that can take an image of the hard drive (as if backing it up - but in a non changing way)
3) Once we have made the clone, place that onto another hard drive that can be explored at will and the files examined without risk of damaging them.
Note if it helps this is for a legal case. The legal team want to maintain the original evidence intact and unchanged should it be required. The clone allows them to explore if the drive has evidence without making changes to the original.
Any comments (or recommended best tools)?