You are partially correct, they will make Mirror Image copies of all the data on all the devices including when things were sent and deleted and copied and moved etc etc on all those devices. Then they keep those devices and evidence while they do their investigation working off of their Mirror Image copies. If there is ever a trial they will need the originals so the defense team can also make Mirror Image copies and work for the defense off of those same copies.
Thanks for the info!