Excellent replies - thank you! Lots of food for thought.
If you're doing a re-install every time (as opposed to VM), how did you deal with multiple cases? Especially with regard to LE. Was it more of a case of replacing the HDD with a fresh one and keeping the "case specific" OS HDD in a store with the other data?
There are multiple ways to do this. Essentially you do one "case" per box/laptop that you have. Typically the most basic setup will be something like
1 OS drive, 1 drive for case data.
This can be as elaborate as one wants since some software can perform better with certain drive configurations. For example, I have used server grade desktop workstations with an OS drive, an on-board RAID, and two additional drive connections in that box to give me an OS drive, a place to store images and data (RAID) and a software mirror (the last two drives) that hold my notes and administrative documents. Do what you wish 'til your hearts content.
The restoration process can vary. Here are some options (not exhaustive).
1 - You have a centralized setup where you have a server that stores the images (Ghost, Clonezilla, whatever you like). You work a "case" on a single machine and when you are done you wipe the whole thing with something like DBAN and then blow out your image back to your machine and your off and running. This setup can be seen most often in large forensic labs where the hardware is the same and the images can be used by everyone.
2 - You have a local setup where you keep your images on a drive and run things as described above. If you have different machines in your inventory, you make images for each make/model or reduce your base image to just OS and drivers so you only need one and reinstall software as needed.
3 - You keep a hard drive library where you clone the OS drive and keep copies and just switch them out. Overwrite the used drive with the clone image and the cycle continues. Wipe all other storage.
4 - You have a virtual server environment where you just use thin clients and generate a new VM for as many simultaneous instances as you want or when you finish a case you generate a new one and go. This one has that issue mentioned earlier of how does one "wipe" the storage for cases done in a virtual array.
5 - You created your own individual VMs and revert back to the initial snapshot
In all the above, you archive off your completed case specific data in the format of your choosing (zip, tar, compressed versions of both, logical evidence containers, etc, etc.) for long term storage (whatever that means in your shop).
As noted, there are many ways to do this and many will recommend the "ideal" setup. The only one who can determine the "ideal" setup is the one running the lab/doing the work because they will know their budget, their processes, their procedures, their preferences, and skill level with hardware and/or automation. Unless you have capital to pay people to do these things one must do what makes their work easiest for them.