They never touch original computer hard disks and floppies. When suspects attempt to destroy media, such as cutting up a floppy disk, investigators reassemble the pieces to read the data from it. Nor do examiners trust a computer's internal clock or activity logs. The internal clock might be wrong, a suspect might have tampered with logs or the mere act of turning on the computer might change a log irrevocably. Before logs disappear, investigators are trained to capture the time a document was created, the last time it was opened and the last time it was changed.
Investigators always assume the worst.
It is a rule in computer forensics that only the physical level of magnetic materials where the 1s and 0s of data are recorded is real, and everything else is untrustworthy. A suspect might have corrupted all of the software operating systems, applications and communications in a computer or the software itself might erase evidence while operating so forensic examiners avoid it. They then correlate evidence to activities and sources. Investigators have many tricks that help them get around the clever suspect. For example, they often do not attempt to decode encrypted files.