It’s just a bunch of decoded databases from an image of a device, with specialized tools to sort through and relate them to each other. Combine it with OSINT stuff, existing criminal records, evidence and ongoing investigations. Now you can map out wwwwwh with relative certainty.

I doubt the courts could force them to divulge trade secrets as to how, specifically, the tech behind the evidence gathering works. The investigator just has to ensure chain of custody remains intact.

For the record, I’m not saying it’s good, but the concept is there and there are many of digital forensics companies doing exactly this. It’s literally hacking, but for The Man. And there’s a lot of money behind it