On Tue, 2013-01-15 at 15:14 +1000, Phil wrote: > I'm proceeding slowly so as not to make matters worse, if that's > possible, and I'll get back to the list once I have some good news. > I know that whenever forensic investigations are done the first step is to image the disk and work from the copies.