Forensic Image of the hard drive means to take an exact copy of a hard drive including deleted files and areas of the hard drive that a normal backup would not copy;
Never boot off of the hard drive;
Use write protection software to protect the original evidence;
Make a copy of the original evidence and do all work off of the copy;
Document all aspects of the hard drive;
Tag and store original evidence;
Best evidence is original evidence;