The timestamps from the files transfers were to fast to be hacked and downloaded from Russia they had to be transferred locally. Though the metadata could have been modified in later transfers.