The forensic copy (using equipment that blocked writing to the source disk) was made at Cisco using Cisco hardware and software.
Don't know Cicso's policy, if any, on this type of thing, but similar things are routinely done within the IT industry. We, for example, have a large collection of...