Oh, no problem...we have a backup of it. Try again.
You are correct
The first process performed when a PC or laptop is brought in for inspection is the drive is removed from the laptop and a Bit level copy is made along with checksums TWICE. So now you have three copies. The original, the master copy with checksums so you can verify its contents should the need arise in a court case and the one that you actually do the decryption work on.
Unfortunately this bypasses all all of the programs that would normally run as a self destruct that would have been loaded on the laptop or PC. You run the drive on a clean forensics system.