That comes under managing your client's expectations and intelligent scheduling. I've had to deal with this even back in the police doing corporate crime, explaining to the detective that whilst we're going to try to get it done onsite, they have to be prepared to seize the computers if there is a problem. If your acquisition is in the afternoon, it's easier for them to accept an overnight image when you're getting their drives back when they start business the following day. I'm also tending to find that clients are happy enough to sequester the computers and have an image performed on a weekend if need be.
I'm also tending to find that drives that are slower than 3GB/s are small enough that you can still get them done in a couple of hours. Any source drives that are over 500GB I've been getting speeds of 4-6GB/min fairly reliably. Thankfully with the increase in size there has been some increase in speed, it's not 11, but at least I'm not pulling 1TB at 16MB/s.
After a looong time, what may provide an interesting case (related to spoliation/order or preservation)
http//
A computer specialist who deleted Hillary Clinton’s emails despite orders from Congress to preserve them was given immunity by the Justice Department during its investigation into her personal email account, according to a law enforcement official and others briefed on the investigation.
Republicans have called for the department to investigate the deletions, but the immunity deal with the specialist, Paul Combetta, makes it unlikely that the request will go far.
Possibly the exception that confirms the rule?
jaclaz