Forensic guys want to take images of the storage devices. They use tools such as dcfldd or purpose-built devices (Tableu) to do this. They'll then analyze the images and probably never touch the guy's hardware again. It will sit in a evidence room for eons. They could return the hardware as soon as they've done the imaging, but I've never seen that happen. Use whole disk encryption everywhere :)