The thing is, they also had no evidence of his even having viewed the files, which means that the last access time was unset. Building a system to reset the acc

The thing is, they also had no evidence of his even having viewed the files, which means that the last access time was unset. Building a system to reset the access time would be pretty involved; more involved, imo, than simply hiding/encrypting a partition.