Somehow I think this thread does not understand the
author's dilema. It is important NO CHANGES occur
during any forensics....dd, cat, cp,  mount, unmount,
another drive, etc, etc...it all does not matter
in a forensics case. 

Maybe he may be facing the (I'll get this spelling wrong, I'm sure)
Heisenburg Uncertainty Principle?

v/r
-mike