As a quiet note … incrementing the journal count when a journaled file system is mounted read-only is not a bug. It is a purposeful design feature.
And incrementing a journal count should not translate into exclusion of evidence.
Ext3/Ext4 recovery updates at least one timestamp (Last Write Time), so it is possible that booting Helix will result in destroying important metadata. However, in our country even mounting the suspect drive read-write and altering file's metadata sometimes will not result in "exclusion of evidence" )
I have also tested many forensics Linux Live CDs (results available only in Russian) and found that many Live CDs, all Ubuntu-based or Knoppix-based, do unsafe mounting with only "-o ro" option during the boot process. I also wrote a patch for casper scripts (initrd) that enables forensically sound mounting of Ext3/Ext4 file systems during the boot.