The forensic copy (using equipment that blocked writing to the source disk) was made at Cisco using Cisco hardware and software.
Don't know Cicso's policy, if any, on this type of thing, but similar things are routinely done within the IT industry. We, for example, have a large collection of older systems and media formats that we allow others to use to retrieve data from ancient tapes, disks, etc. Usually, we do this as a courtesy to those in our community, and would only charge if the effort required were extensive.
I expect that K will call the FBI related witnesses back for questioning on topics that the pros. avoided introducing during their earlier testimony. Probably reworking Ward's reports to avoid the restrictions imposed by how computer and networking expert vs forensics expert are defined foravoid this case.
The whole FBI/national security/protected methods shielding of prosecution "evidence" has become a convenient epidemic. Swear in a local police detective as a Deputy US Marshal on the FBI Cyber Crime Task Force, and magically he avoids all those pesky defendant rights issues. Terror! Terror! Terror!
