Connecting a USB device without a write-blocker

Ah yes that is a very good idea! Thanks.

Ok here's another quick question for you… What AccessData's Forensic Toolkit? How does it stack up to others?

Thanks for all your help so far.

AccessData FTK, EnCase, ProDiscover, Paraben P2, X-Ways and some others are the commercially available Swiss Army Knives of forensic tools. There are plenty of threads on the merits (or problems) of these tools.

Ok thank you very much.

This is an attorney's dream. If you do not have a forensic image of that drive the attorney is going to scream that the evidence is tainted. In particular the evidence on that drive "could have been manipulated". How would anyone be able to prove otherwise without the original intact as it was the day it was seized.