Introduction
3 computers were sealed and taken from a persons apartment. Investigators invited him to unseal the PCs, they were intact and they started the cloning process, however the hashes were just photographed by an expert without putting them into a document and giving it to the one who's being investigated, saying that they will invite him the next day to finish the paperwork, but after 4 days, he still hasn't been invited, meaning that all the devices has remained unsealed all these days.
All hard-drives were cloned using a write-blocking device, looks like this one.
Software that was/is used in investigations is FTK if I am not mistaken.
Question
How can investigators prove that the data on all the hard-drives were not modified during these 4 days, when the devices were unsealed and they had full access to them without the consent of the person who's being investigated?