thanks.
copy\paste from the NYC PC to the thumb drive.
Someone takes out the thumb drive.
When I use Microsoft Remote Access to my home P.C., whatever I do regardless of where i am at, timestamp is from my home PC.
Where would meta data show something different ? Thumb drive ? that would be gone.
In order to have confidence in the timestamps as an analytical tool, one would have to know or assume the tools and means used to effect the transfer, copy, and compress operations.
The most common effect is the one you describe - timestamps reflect the time the copy is made. Timestamps are usually preserved (not updated) when a file is copied/compressed into an archive. Timestamps are generally preserved by backup software too.
I often use "wget" to get remote files. "By default, when a file is downloaded, its timestamps are set to match those from the remote file." That is what I would call preserving the original timestamp in the copy.
I also use "scp" which is a sort of remote copy. By default, "scp" updates file timestamps to the time the copy operation is performed.
Also consider that "archive before transfer" can give different results from "archive after transfer," and the possibility of transferring (copying) files over a local network; from a host to a destination machine.