When a forensic image is created from a live, running system, will the hash value of the image ever match a hash of the running system’s hard drive? Why or why not? If not, how could you explain this in court?