[shakna]

Yet creation time is still useless in this case, because forging it is still trivial [0][1].

A chain of custody with extremely rigorous procedures and protocols is the only reason a forensic expert has some level of trust.

Without that, and with incentive, this becomes nothing more than a farce.

[0] https://www.howtogeek.com/203154/how-to-change-created-or-mo...

[1] https://www.freebsd.org/cgi/man.cgi?query=touch&sektion=1