forensics: elaborate on change time file attrs

[bodik]

C in MAC times does not stand for creation (as it corelates many times) but for 'change of attributes'

elaborate more on text just to remind myself

[bodik]

also elaborate on relatime mount flag