Law enforcement do not care about your uptime. Law enforcement do not care about your losses. They want to preserve chain of custody and integrity of evidence. If your gear is seized as part of a raid, they'll take your whole machine. If you want to prosecute someone for breaking into your box, they'll demand a provably identical image of the drive, obtained via a method that is known to be forensically sound. For this reason, companies like Guidance will send someone to defend their forensic software in court for free, if you require it.
Law enforcement will not accept a VMWare image, because they have to prove to a judge that they have a 100% accurate copy of the data. Trying to defend a non-standard process when they've got defence lawyers staring them in the face is not something they want to try. The notion of the technicality is a common one.
At the end of the day, you need to ensure that you can make a forensic copy of the drive, and maintain chain of custody on the evidence. A defence lawyer will ask you how you know that the copy was accurate, and how you can prove that the copy or original drive was not tampered with. If you can't answer that, they'll tear your case apart.