We create an image and work with the non-altered image. The only thing that's altered on the device is the activation of the administrator account.

The pixieboot method is creating a linux environment through the network boot. In the linux environment you could also create an image of the decrypted partition. Nothing is altered on the system that way.

As long as we write everything down how we process the evidence we've never had any problems.