Perhaps you misunderstood my post. Coalfire didn't receive any hard drives. All they got was a flashdrive. If they copied the videos onto the flashdrive, they could control exactly what information was sent to Coalfire.
You can dig into the metadata on a flash drive. I know in specific copyright cases, it's how the original owner of stolen imagery was obtained.
How deeply you can dig? I don't have the answer to that.
But, I will say that this is Coalfire's area of expertise. So as of right now, with all the facts on the table as we know it........we have to take their word for it. They don't have a dog in the race, and they are hired to be impartial.