From what I have been reading here... You want to have your own forensic tests done... The feds are NOT as trustworthy as you would think (voice of experience here). I am currently waiting on an email (or call) back from our lawyer about this subject right now.

First thing the forensic computer people will do is image the drives, which is nothing more than making a mirror image of the hard drives. I have heard of this being referred to as cloning a drive.

They probably perform some kind of sector-by-sector operation when making this mirror image. I think that sometimes they use a write-blocker to insure that the image they are creating is an exact copy of the hard drive in the computer.

This gives them a working copy from which they do all their forensics.

It is from this image that they begin the forensic examination to determine the content of the drive. There are several programs to choose from and I am not familiar with them all. For years they used Encase and later they began using FTK, but so many newer ones have come on the market that I just do not know what is being used now.

This leaves the original computer intact. I do not know for sure, but I have heard that sometimes when the computer is returned, it has been wiped. But I do know of one poster on the forum was able to get her computer back and all the data was intact. So I don't know what determines if they wipe the data or not; maybe it is the policy of the particular agency that performs the forensics.

To answer your question, the prosecution---the forensics people----will give a copy of the image along with a detailed report of what was found on the drive to the defense. The defense can use that image to have their own forensics done.

Different forensics labs may use slight variations to this procedure, but the main points are the same as I described.

Hope this helps.

rewdiazepam

All of my pictures came back in tact. Thankfully! I was very concerned they would be erased, but they were not.

Rew is correct on how they mirror and use that copy. That's the same one our forensics guy used.

They told us that we had until sentencing to get ours done, because after that the computer would not be available. I don't know if they trash it or what.

In my son's case the FEDS forensics were redundant, and abundant and really didn't tell what was going on. It was so convoluted and so much to wade thru that it really made it seem like my son had hundreds of issues.

Our forensics was understandable and it was 2 pages long. We used a forensics guy who the court knew and respected. He's also told us that if we ever need him he's available for us. He knows our forensics proved my son was innocent.

But had I not done those forensics I would have nothing now to backup my son, in that case, where in the future, we can use it to show my son's innocence. We have proof.. even tho the judge didn't want to know about it . . then.

Rew is correct. They make an exact mirror image taking great care as to not write anything to the hard drives. I got everything back (after 2 years) with the exception of the hard drive that had supposed images on them. They returned a work laptop to my company minus the hard drive...

I do not trust their methods at all. Yes, they say that they make no writes to the hard drive but who actually checks on this? There are many programs that alter the date date of a write and/or a delete that are undetectable!

I agree Coolrich. In fact my son's sentencing and release papers have a full description on the front page of a cp with 3yo. They found a snippet of something close to that cp. My 2nd forensics was a search for just that one and there seemed to be a partial download of one with part of that snippet but was unaccessible to anyone.
My son was supposedly charged with 1 cp, it wasn't this 3yo one yet they pulled it from their files and stuck it on the front page of all my son's paperwork. The prosecutor refused to take it off. Because it was a part of their forensic report.

So, something not found on my son's computer was a full paragraph description of a 3yo in cp.

It was clear as day but things were twisted and our hands were tied.

So in the end my son was not charged with that 1 because it wasn't on his computer. Yet the feds had the full cp in their library and they used it. If anyone really cared and could, I would sue the government for bullshit.
I've gone to many lawyers, no one sees a problem with this. All this because they used the forensic in their creative , twisted way.

Who actually checks on this? Your private forensics. If the computer is even booted up files are updated with current time stamps.

I'm not saying that LE is to be trusted but there are physics that can not be altered. There is a bit line that when disabled will not allow any hard drive writes. You cannot boot the computer with this bit set.

Once they have the copy though they can do anything they want leaving it up to your own independent forensics to prove them otherwise. They never showed me the images that they said I had....