[clug] OT: Hard disk search

[James]

> As this is a criminal activity I would be approaching that AFP immediately
AFP were involved, they got subpoened, that's why we need an independent
person to do the job. But otherwise you'd be very correct.

> If the disk was mounted in a computer and files open and closed, file date
> and time stamps may now have been altered ie the evidence has been
> compromised.....
Thanks. Definitly worth considering.
I'm still having troubble explaining the mechanics of dd, imaging,
filesystems etc. to the solicitors involved. Fun, fun! :~)

-James