Working with drives
From what I understand there are some USB to hard drive adapters that are read only adapters. Connect a regular hard drive using one of these devices means that you won't accidentally time stamp anything.
The first step is to make a low level copy (the linux DD command is an option) of the original and generate a hash of both drives so you can verify the original and copy are exactly the same. Next you put the original in a secure location and don't touch it again. I believe that some people then make another copy of the copy and then use the second copy to do scan's of the drive content. The stuff I have read sounds fun and interesting, but I haven't ever done this. There is also a lot of down time involved with all the copying and scanning of the hard drive so have a good book handy.
Bill
