The "forensically sound" method is to never conduct any examination on the original media. There are practical and legal reasons for not performing the examination on the suspect's computer, but sometimes you have to compromise. If we make a compromise, is it acceptable by the court? What is the best practice for us to deal with these scenarios?
This solution examines if examination of evidence on original media is a forensically sound idea or not. It also deals with the measures to be taken while examining computer forensic evidence.