Getting a consistent snapshot that you can restore reliably is a hard problem but probably not as big deal for forensic analysis.