The 6 for the open are all the same. The 6 for the closed are different from the open, but all the same. Your example from yesterday has different values for each. How do you explain having all being the same?
Keep in mind that I don't have the top secret missile-launch-code-preserving, kiddie-




-ring-busting, FBI tool to analyze the FAT. So, I don't have 6 timestamps per file. I could probably go download some freeware FAT analyzer, but I'm not inclined to do that on my work PC. If you want to do it on your PC, go for it.
Again, I wasn't making any claim about the timestamps that I showed because they are showing something different from what was shown in court. I was just trying to explain the correlation between the .cur file and the .bmp file. I
really wish I hadn't bothered now.
There are 2 files in play here. The .cur file which is remote and is downloaded from maps.gstatic.com and the .bmp which is the cached version that is downloaded locally and stored in the temp internet files.
What I attached was what Windows Explorer shows you for the cursor. The popup is showing you info about
2 different files. It shows info for both the .cur file and the .bmp on the same popup. The create time (sometime in 2009) is the time that the .cur file that is stored at maps.gstatic.com was created. The access time is the last time that the .bmp file was last accessed from the temp internet files on the local disk. The third time shown on there was an expiration time. That's how long they will leave it in the cache before forcing it to be refreshed. That was 1 year from the time it was downloaded.
I assume that what the top secret FAT analyzer is showing is times for the .bmp file
only. It would make sense to me that the create, modify, and access time could be the same. I don't know what the other 3 times shown were. Maybe I'll google it later and get the answer to that.
If you didn't have a .bmp cache of the closedhand file, for instance, but you clicked and dragged a map, they are going to go get the .cur file from maps.gstatic.com to show you the little picture of the closed hand. They are also going to create a .bmp cached version of the hand picture on the local disk in temp internet files so they don't have to keep going to get it from the Internet. In this case, I would expect the create, modify, and access to be identical and they would be the time that the cached .bmp was successfully saved on the local disk.
If you subsequently did something else, probably leaving Google Maps (causing the RAM copy of the hand image to get flushed) and then came back and did click+drag, it would access the .bmp file again. Now the create and modify times would be the same but the access time would be later.
If you never did something causing it to need to reload the hand .bmp, the create, modify, and access would stay the same.
Someone posted yesterday and asked what the info that I had posted meant in plain English. The answer I gave is what it meant was going to be fully dependent on whether you've already convinced yourself that Brad did it or that he didn't do it. That's exactly what happened. I didn't have any agenda when I posted the info. I was just trying to help. Shouldn't have bothered.