A guy I knew in college had a rootkit installed on one of his servers. FBI and GBI took his drives (I was his RA at the time, definitely was law enforcement, not a 18 year old's exaggeration). They brought them back around a month later after the crime lab made copies.
Okay, that isn't at all like how police actually work. For most cases, police don't bother sending most of the evidence to the lab, because they won't get anything back except the one or two pieces that are absolutely essential to convict.
In that environment, I'm not at all surprised it takes a month to copy hard drives.
