[throwaway13234]

Yeah, I wouldn't expect logs for every file, but I would expect logs for the insertion of a card into the card reader and mounting a logical volume from that card. How big was the card/volume, if any? And if there even was one, was it even big enough to hold the entirety of that repo.

Also, while copying isn't auditable on windows, windows can audit object reads and writes. Were there any logs showing that the directory with the files were read while the card reader was inserted into the machine? It's off by default however. Does anyone know the default audit settings of a new google windows installation to know what folders it turns on logging for if any?

https://technet.microsoft.com/en-us/library/cc976403.aspx

These are all issues and details I would expect to be mentioned in an expert's report if they weren't trying to be selective in the details they provided. Since this expert works for Google, omitting details in Google's favor wouldn't surprise me. I didn't see any statement in the expert's report where they had to make a statement under oath where they declare that they aren't omitting any other details that may be relevant to the court. Without such a declaration, it's possible to be truthful, but deceptive without perjuring yourself.