There was more to it than just "time stamps." There was an expert examination of the messages, and the fact remains they were offloaded faster than could have been accomplished using a remote access (especially if over the internet, which is painfully slow). Had to have been done on a local mass storage device. There was simply no way to have moved the quantity of data that was pilfered in the amount of time it appeared to take.
No, there was either incompetent examination, or incompetent reporting. The "evidence" was basically wrong on every level.
You can't tell anything about access/copy time from examining the messages themselves
except by looking at timestamps, and as I mentioned, those are worthless as evidence for several reasons.
As I mentioned, the Internet is so much faster than a local device. Your connection might suck, mine is at least twice as fast as a USB2 connection and if I paid a little more I could go 10x faster -- and that's just within the residential tier. If you have the money to pay for it you can get a network that is faster than HRC's server could transfer it to ANYTHING.
BTW, even if HRC had a really crappy internet connection, and there was a foolproof way of determining the speed at which the files were copied to their final location, remember that you could only measure the FINAL transfer. So if they really did use a locally attached device, and then copied the files somewhere else, you could only measure that second copy. The only way to measure the speed at which the files were copied off HRC's server would be if you were examining the thing they were copied to, which obviously they are not because they wouldn't be using words like "such as a thumb drive" (not a direct quote), they'd be using words like "the thumb drive" -- though again even if they were that doesn't prove they're not just looking at a copy of a copy of a copy.
There's basically nothing in the (reported) examination that has any basis in reality. BTW, that's true of an amazingly large percentage of what you see reported and pretty much anything you see done with IT on TV. I watched a movie some years back in a area with a lot of IT workers, and when they used an actual command (nmap) with the correct syntax and output the crowd actually cheered -- not because it was an important plot device or turn, but because we've never seen accuracy before.