If it's all theater, then it's worth pointing out the A/C/M times of files are easy to fake. A competent intruder can feather filesystem times and modify logs to point investigators toward the wrong conclusion.