>NYPD could have possibly cloned the drive
I think that would be done pro forma before anyone booted up the laptop. Proves no evidence tampering, or guards against a booby trapped machine that could initiate some kind of wipe script, etc. I wonder, also, if they remove the drive and look at it with another OS or just boot the original machine.