To access a suspect’s computer, traditional procedure involves removing the hard drive, creating a forensic image (a duplicate copy) and then analyzing that copy using sophisticated ...