Hello , I have a dilemma…
client is working off a laptop that is running out of storage space. Her other MacBooks were seized as part of an investigation.
Her employer, sent her a “Preservation Letter,” mandating that she not destroy or delete anything, including emails and draft documents.
She wants to continue using this MacBook and wants to purge some of the unwanted files, but we have advised her that she can’t destroy them, and instead, must move them to an external hard-drive.
How do we do this without losing any metadata? I’m particularly concerned about “author, created, and modified” info.
Is there a forensically sound way to move these files to a drive?