I think they tried to delete them and I think recovering them is very important whether or not a White hat team has them. Because they can corroborate your evidence and a lot of important stuff lives in the metadata. If you can get that information off of the machine you now can prove that your data you captured is good and implicates the technology and machines you are accessing of making those changes.