Hello...i'm new here

I want to study computer forensic at degree level next falls, but before I apply for courses, I want to get as much knoweldge as possible. So one of my question is that what is the normal procedure usually taken when a computer is ceased from criminals, paedophiles, terrorists, Fat Tony, etcetra ?

I guess they a make a mirror image of it, and leave the original intact, what next? what kind of analysis is undertakene etc If you can show my in the right directions, that will be splendid....