While performing surveillance, PI Slade looked through curbside trash behind Mr. Koptstadt's office and found a USB drive. PI Slade has asked you to look at the USB drive and recover any data and make a copy.
He wants to know when the data was created and anything else about the USB drive contents.
What strategy or standard will you need to use in this forensic scenario?