Forensic tools used by law enforcement and intelligence organisations don't modify the system partition; in fact, modifying anything on the phone is highly undesirable, from a forensics point of view.

Re needing to wipe the disk:

1) Modern Android has 'adb backup' so if your phone is not locked, someone who got ahold of your phone can use it to dump your data from a non-rooted phone.

2) Law enforcement and intelligence organisations may or may not have tools to dump your data directly off a (desoldered) flash memory chip. You need to enable disk encryption (* ) to protect against this.

(* ) I'm assuming a disk encryption that's not rigged, i.e. has no key escrow available to law enforcement.