The most important consideration for a forensic auditor is to make a bit-stream image of the target drive and examine that image without altering date stamps or toher information attributable to the examined files.

спасибо, мерси грасиас