Assume all data on the drives has been cloned.
There's little chance they didn't.
There's little chance they didn't.
If the data was cloned on-site, then we wouldn't have heard about the search warrant (there'd have been a gag order).
And as this happened yesterday, there's almost no chance that the server could have been taken to the lab, imaged, and then returned to be reconnected today.
I would bet 100 dollars that the actual target server of the raid is still sitting on a dolly in the forensics cage while a tech is waiting for someone to tell him what he's supposed to be looking for.
However, field cloning is absolutely not the desired procedure to use (for a lot of reasons). You only do field cloning if you are either: 1) Under a time crunch, or 2) Don't want the target to know that the clone has occurred.
If at all possible, you just take the equipment and process it in the lab.
I've done about 2 dozen of these for the FBI. We did field-cloning maybe three times.
Assume the FBI has a copy of everything on the drives and assume that they will see every file on the drive, even though odds are they don't and they won't.
He should contact the FBI and continue to beat on Digital One and determine if it was seized or not. It very well may have simply been turned off, is that not a valid possibility?