Over the past decade or so we have seen a massive increase in the usage of digital devices for evidence gathering in law enforcement, and the methods that we have used are typically based on "dead" forensics, where investigators examined a powered-off computer which had an image taken of it. In itself the focus has always been to preserve data, and comply with the ACPO regulations for the handling of the seizure of data.
Buchanan, W. J. (2015). The increasing challenge for digital forensics. The Texas Investigator, 10-12