Question: I am trying to extract the data in every fourth cell. For instance the data I want are in cells A1, A4, A7, A10 etc. When I enter =A1 in cell B1 and =A4 in cell B2 and selecting both cells and then drag down instead of entering =A7 in cell B3 Excel enters =A3 in cell B3 and =A6 in cell B4. B5 and B6 gets filled with =A5 and =A8 respectively. When I enter 1 and 4 in cell B1 and B2 and drag down I get 7, 10, 13 etc. as expected.

I tried disabling and re-enabling fill handle and cell drag and drop but without success. Any ideas as to why this is happening will be very helpful!

Answer: 
You don't.

There are actually two schools of thought in regard to forensic disk imaging.

The *oldschool* method was to unplug the PC *immediately*, and image the drive in *that state*, to ensure that nothing got changed. It also assured a certain degree of plausible deniability...

And that didn't really work too well the moment folks realised you could encrypt a drive with a password. 

While *live* forensic capture doesn't ensure that *nothing* at all is *ever* altered, with proper logging, you know what the examiner has done. It's also handy since if the suspect hasn't locked his system you can probably get enough data copied out to work out what's happening. 

> 
> I learned in forensics you can deploy an agent to a remote computer and have it retrieve an exact copy of the remote hard drive, including unallocated space and swap, even while it is being used. This copy gets sent to your pc over the internet by the agent and then you can work on it on your pc.
> 
> 
> 

Feels like you're confusing both processes - you'd *either* run an agent and other tools on a livedisk, or pull the hard drive to image in the 'traditional' methods, or use live tools, or good old investigative work on a running system. You can't really get a proper forensic duplicate on a running system.

[EnCase](https://www.guidancesoftware.com/encase-forensic), for example, lets you work on a VHD or VMDK made with another tool - but you aren't going to run it directly on a system being investigated.
Yes, In some cases you have to have a physical link to the device, and permission. If not you will need hash sets and a court order. Careful.. this is wiretapping