hmm the first response is consistent with what I said.

The second one is arbitrary because email can be run through remailers that don't keep logs and it can be spoofed.

You are right about timestamps. They are called MAC times. MAC== modified, accessed, changed. If you are dealing with NTFS partitions then the information is all stored in the MFT. The MFT is a story for another day though.

Nice to know someone has access to a lawyer!