The invalid timestamps have now morphed into "modified timestamps". I don't know that evidence has been given that the time was modified. An invalid timestamp can occur if the time on the server a computer is accessing is incorrect. It isn't always something on the computer itself. I personally only got to see a document that showed two files; the two cursor files. Last night was the first time I became aware that there were 500 files. Information on all the files would have been helpful. Also, and I don't know the answer to this, if a person attempts to delete a record of a search like this and removes a file but through a forensic search the experts are able to find the search still on there, could that deleted file have caused invalid timestamps?