In contrast, a forensically-sound copy of user data is not nearly as comprehensive as a full forensic image of a hard drive. Instead, a forensically sound copy of a particular set of data faithfully transfers the active data (meaning files that are still resident on the disk) for selected files, bit by bit, from the source, without altering each files modified, accessed or created dates. Often, forensically-sound copies are limited to the user's home directory contents in particular, files that you could actually see if you sat down and the computer and browsed through the files in the users account. If the user deleted something the day before, you would not capture any of the data from the deleted file. With a full forensic image, you would very likely capture some or all of that deleted data.
The advantages of a full forensic image are probably obvious: the parties are guaranteed to have at their disposal every piece of information that exists on the subject device, even if the information is disguised, obfuscated, corrupted, wholly or partly deleted, stored in nonstandard ways or locations, or is otherwise difficult to analyze. Such a collection also provides forensic analysts with the breadcrumbs and fingerprints that are left behind by certain activities, such as browser cache and history files, which may be material to the litigants.
