An IT administrator’s job is to keep systems running. A forensic examiner’s job is to capture data without changing it, document every step in a way that survives cross-examination, and produce hash values that prove the image is bit-identical to the source.
The two skill sets overlap less than people think. Asking an IT person to perform a forensic acquisition is asking for evidence that will not hold up in court.