Tedob,
If this could result in criminal litigation, you have already tainted the evidence. You should only ever do live forensics if you need to collect something running on the machine. If...