Agreed, this is creepy, unnecessary, and possibly even damaging to whatever litigation is pending. (Assuming the litigation thing is even true, which I personally doubt.) Even if they do need an image of the drive, the people in IT shouldn’t be the ones pawing through it. That’s a job for a professional investigator or a lawyer. I ran an IT department for four years and if any of my staff did something like this, at the very least they’d be getting a closed door conversation about why this isn’t ok.