> the cops are worried that, if they boot up the computer, it'll have a program which notices something is wrong and wipes the hard drive

That's why you take the drive out and image it and keep it powered down and analyze just the image. You don't boot the computer you seized as evidence.