Many of the actions an individual might take, including rebooting the machine, copying files from the server, and reviewing security logs, can alter the drive data.

• 一些单独的活动可能要进行，包括重新启动机器，从服务器拷贝文件，回顾安全日志，改变驱动器数据。