As @roamer_1 has pointed out, the tech started off with a copy of the drive's image before he even looked at the directory trees. It's the first thing a recovery specialist does. He didn't have to go out of his way to make a copy because he would have already had it in his file server. In fact, he could produce an exact copy today, if asked.
That's right... Right now, I haven't looked lately, but I am probably carrying around eight images in the server... Only one of those is current - I just finished a recovery about a week ago.
The first thing is to pull a raw image of the drive. Hopefully that is the only access to the physical drive I will ever make. All recovery attempts will be made from that image, rather than messing with the original drive... And at that, the original image is kept pristine too, being used over and again to copy onto a working drive where the actual recovery takes place. That working drive may be scrubbed and re-imaged multiple times, during multiple attempts.
After a successful pull is made and the results assembled into a recovery, I will keep the image around for a while... Usually something between 30 and 60 days, just in case some critical data was missed that I might have to go back in for. Super critical drive images may even be kept longer.
I don't control all that by the way... the folder structure that I store images to, and the folders the recoveries reside in are automatically cleaned out every thirty days by script, so the longest I will keep an image/recovery is approaching 60 days unless an image is special (like a lawyer's drive, which I might hold until the cases he is working on close)... Those special drive images and their recoveries are handled manually and stored differently.
