[mcao]

A duped drive would be useless. When you delete a file, the OS marks it as gone, but the data is still physically on the drive until you overwrite it with more data. The forensics team would need access to the original drive to uncover that data.

[wglb]

Don't such forensic activities do a sector-for-sector copy of the original hard drive and work from there? So the access they need to the drive is limited to the time it takes to do an image copy.

So if by "duped drive" you mean an image copy, it is not useless.