Every LEO doing "forensics" is basically an EnCase jockey today. It's not like they're shipping these things to Quantico for imaging under a scanning electron microscope.

Regardless, the reason for online tools like Coffee is that you want to preserve an image of the running system. Removing the hard drive defeats that objective.