How to do it…

We perform the following steps to forensically copy files on a Windows system:

1. Gather source file and destination arguments.
2. Use shutil to copy and preserve most file metadata.
3. Manually set timestamp attributes with win32file.