[marysol5]

You do not do any writes in a forensics scenario. Especially if you want to make it stand in court.

You have to always keep a clean hashed copy, and then work on copies from there.

[phyzome]

You can't make a "clean hashed copy" of hardware.