Leave the drives in in their native environment , mount the drive across the network and make the image. In this case, I don't see how I am writeblocking since the machine will be running and have access to its drives.
Maybe I didn't make it clear to those not familiar with Encase. A network acquisition in Encase is conducted by connecting the two machines (suspect and forensic) via a crossover cable (supplied with Encase) and booting the suspect machine with an Encase DOS boot disk. This will load the drivers for the network card on the suspect machine and start Encase for DOS on it. There is nothing else on this "network". As the suspect computer is in DOS there are no writes made to any drive unless specifically commanded. Encase for DOS has a feature to allow the examiner to further lock any suspect drive so that writes are not inadvertantly made. The examiner places the suspect machine into server mode. The forensic machine is running Encase in Windows.