[reed13k]

As I understand one of the first forensic steps is to mirror the drive prior to conducting any other work. Then all the work is done on the mirror drive to prevent any corruption of the original evidence.

So provided they didn’t destroy the mirror then they have it all.

[stylin19a]

Don't choke.

from the IG June 2018 report - footnote 165. Case agent was working off the mirror of Weiner's laptop. Don't know how many images were made.

No electronic record exists of the case agent’s initial review of the Weiner laptop.

The case agent told us that at some point in mid-October 2016 the NYO ASAC instructed the case agent to wipe his work station.

The case agent explained that the ASAC was concerned about the presence of potentially classified information on the case agent’s work station, which was not authorized to process classified information.

The case agent told us that he followed the ASAC’s instructions, but that this request concerned him because the audit trail of his initial processing of the laptop would no longer be available.

The case agent clarified that none of the evidence on the Weiner laptop was impacted by this, explaining that the FBI retained the Weiner laptop and only the image that had been copied onto his work station was deleted. The ASAC recalled that the case agent “worked through the security department to address the concern” of classified information on an unclassified system. He told us that he did not recall how the issue was resolved.