Can image the hard drive remotely if it has been removed from the laptop. Drive will require connecting to a computer with a hard drive larger than the laptops drive. I am a computer and network security PhD student with work experience within digital forensics for law enforcement,and also teach computer forensics in a U.K. university. If no write blocker is available on the remote terminal, you can either post the drive to me, or enable remote access to a Linux based computer