Digital forensics student ama, just did a practical final imaging a shit load of drives using various systems.
This seems to be the most popular device used, but there are sevral other options.
voomtech.com/#!hardcopy-3p/c1q2b
There are also software and hardware wright blockers that are sometimes used with regular computers. It is forbidden to just plug a suspects hard drive into a computer to see whats on it.
Once a dd image is created the most popular tool for initial investigation is FTK
accessdata.com/solutions/digital-forensics/forensic-toolkit-ftk
Rarely (from an image) a vhd is created to boot up a system in a virtual environment or wrewirtten to an hdd to boot on actual hardware.
The most common thing to do when seizing a computer for investigation is to unplug it from the back of the computer thus preserving swap file info. Photographs of what are on the screen is permitted, and moving applications around to document what all is open when the computer is found is permitted but closing or opening anything is forbidden until after the drive is imaged.
BTW a drive image captures every bit, even slack space, unallocated space ect. After the computer has had it's hdd removed it will be booted back up to check the accuracy of the clock in bios/ueif and record mac addresses and such.
In cases of full drive encryption there are kits that allow the computer to be removed from the property in a powered on state, there are methods to retrieve encryption keys by cooling and transplanting the ram but this is usually not done on site. Many agencies don't have the resources to do this, they will just unplug the computer like normal and hope to crack it some other way. In the digital forensics program we are told that any system is crack able it just depends on the amount of resources available to use, and in many cases if the drive is encrypted they just keep an image for long term storage and hope new technology or resources allows them access before the statutes of limitations expire.
We are instructed in class that a suspect can not be forced to hand over passwords or encryption keys, but many times they can be convinced to do so anyway, our job is not to be there lawyer. (we are evil, right)
Next semester I get to dig into small devices and do chip off forensics. ^_^