Quote:
Originally Posted by Toadrax
It might be ineffecient and pointless to "image" the drive, they might just do what I do and put it in a caddy and copy all the files. Doesn't take long.
|
And that would miss everything that was deleted, stored in hidden partitions, or in slack space hence the reason they have to image the drive. Not including making it admissible in court because you have an exact copy of the entire drive, not files from a drive that now have all of their dates changed.