[kbenson]

Apparently they've never heard of rsync and -t (--times), which is implied by -a (--archive), which is recursive and copies all relevant data for archival purposes, and is the first flag I use with every single rsync command? There are plenty of file copying/syncing techniques that preserve timestamps, and if the files were previously copied to/from a device that did not (such as a thumb drive to the computer they were eventually stolen from), then it would stand to reason that the modification times would represent the times of that prior copy operation.

I mean, file timestamps have been used by some really smart people to make intersting assumptions about what's going secretly on in very interesting ways, such as Tsutomu Shimomura reportedly looking at library access times while covertly on the same remote system as Kevin Mitnick to make assumptions about what he was compiling (I don't recall the source, it may even be made up), but this isn't one of them.