I too wonder why the prosecution team did not offer reasonable explanation for the timestamps. Personally, I believe the prosecution "experts" truly were not experienced enough to render a detailed explanation so they said they did not think it was tampering. After all, the expert witness is allowed to render an opinion based on their knowledge and experience. It never says how much knowledge and experience are required. IMO, I believe also that the prosecution was afraid of something on the computer that might cause the timestamp to be questioned strongly. I have never seen a prosecution fight so hard to keep testimony out of a case.
Here's a slide of the timestamp info for the cursor files.
I think it is clear that the correct time for these files is 7/11/08 17:14 UTC.
I don't think it needs further explanation.
The time was corroborated by other personal computer activity before and after this time.
The time was corroborated by witnesses placing him with the computer at that time.
The defense did a yeoman's job finding questions that they could not answer in that data, and trying to lead the jury to the conclusion that this somehow creates doubt.
But really? Can you look at that slide, understand the corroborating details, and genuinely believe that these files are anything other than a by-product of a search done at 7/11/08 17:14 UTC? Really?