The "forensically sound" method is to never perform any examination on original media. There are practical and legal reasons for not performing examination on suspect's computer, but sometimes you have to compromise. If we make compromise, is it acceptable by court? Explain the best practice for us to deal with these case?