@emptywheel @matthew_d_green After a cursory review of the whistleblower transcript (item 20), there is no reason I can see why you'd do this. It's honestly a bit perplexing to me. But this drive seems to have been mishandled at every turn - at least this is consistent...

Alternate theory: it's inarticulate wording?

@malwarejake @emptywheel @matthew_d_green It seems like the last thing you'd want to do is boot it. I'd use something like a gparted boot disk or Puppy Linux to boot from usb and image the whole drive that way.

i assume there are more professional equivalent tools.

@RandomNunesParody @malwarejake @emptywheel @matthew_d_green Agreed. The one class on computer forensics I took almost a decade ago taught me not do do those things and to maintain the integrity of a forensics image. As @wpoland says in a later post, they should of been using a write-blocker in order to make a clean forensics image.

The whole Hunter laptop thing is a great example of what not to do when forensically examining a computer!