- An image created with the dd command would allow for recovery of deleted files.
- A bit-for-bit copy (dd style) is the only way you'll get something that is likely the only forensically useful approach for law enforcement / court.
While there are ways to compact all the files on a system and copy over / update the boot record, this is not forensic. The only valid forensic approach is to copy everything exactly as it is and preserve that. You may be able to copy everything and then zero out all unallocated space (freespace wipe), but that might limit your ability to use it for anything other than trying to find out what happened. Even then it will limit your ability to discover certain types of attacks.
If your goal is to seek criminal or civil action, you have an uphill battle to show that any kind of modification to the system state is appropriate for evidence in any jurisdiction. From an expert witnesses position for the opposing side, I'd rain hell all over it. This is akin to cleaning the walls before investigating a murder scene.