The very least you can do is look at the time the file was created.
Also, he can't verify a file without looking at it. If the "security experts" opened the file before doing a (very careful) backup (which kept the disk-intern metadata), the access time has been changed, so you can't find out, if he even looked at the file. This shouldn't be the case, if law enforcement worked with care, though.
The creation time should still be intact, though. You could check that with the logged time.
Also: Did he download the file himself?
Can you check if the LimeWire has been tampered with? There are some worms anv vira which manipulate a LimeWire to spam. If the LimeWire was manipulated, your underage is the victim of criminal worm or virus authors who stole control of his computer.
The Storm-Worm for example is said to have control of more than one million computers around the world.
This would at least give him plausible deniability.
(What we learn from this: Don't use Windows...) |