I encourage FDE enthusiasts to watch this video. It reminds us how crucial to have our system to be fully encrypted. In short, Forensic Imager Tools: You don't have the Evidence - Shmoocon 2014 https://www.youtube.com/watch?v=zYYCv21I-1I 1. There are reallocated sectors happening during any imaging process. It means that (during imaging) a hard drive contents are being modified without them knowing or speaking about it. 2. Most forensics do not really image out the hard drive 100%.