But this isn't a way to do a forensic analysis. You just clone the hard drive. Anything else should not be able to stand up in court.

Afaik it is practice in rule-of-law countries to hand a clone to each party in the case.

Forensic analysts must use read-only adapters to clone hard drives.

This wasn’t a forensic extraction of data from a recovered hard drive, it was a drag net across email server, file servers, content management systems, wikis, phone records, written notes … basically every form of communication that left any trace.

The ABC staff literally copied all the stuff that might be interesting (found using keyword searches) into a folder, which the ABC legal and AFP investigators went through one by one to determine what was of interest to AFP. The items of interest was then copied to a “sealed” package which the AFP pinky swears nobody will look at for two weeks while the ABC seeks an injunction.

Or the right to install spyware.

>Perhaps they had a ruling in the past that during accessing a computer, things got changed, like the logs

they don't have imaging tools and/or write blockers?