Question: The "forensically sound" method is to never conduct any examination on original media. There are practical and legal reasons for not performing examination on suspect's computer, but sometimes you have to compromise. If we make a compromise, is it acceptable by the court? Determine the best practice for us to deal with these scenarios?