Cybersecurity

Hi
I am requesting your help to obtain opinions and testimonials in order to be be able to make my own opinion since I am definetly not a unix expert.

Say we have a UNIX server.
On this server there is a specific directory let us call it "DIR"
A security incident have been reported related to this server.
Expert in forensics analyzed it and wrote this (modified a bit for confidentiality reasons)

Files : File1 to File14
"The above files were known to have been present in the directory. File system timestamps indicate that they were last accessed arround HH:MM on D Month Year and deleted around HH:MM on D Month Year. Investigators have attempted carving these files from free space on the system to determine their contents, however the files were unrecoverable. Some of there files may have been present for legitimate purposes."

Files : File15 to File20
"Due to the files' metadata having been overwritten, the initial date of their presence and their deletion date are unknown."

Since all files (File1 to File20) are supposed to have been present in the same directory (DIR) is it possible to succeed in identifying access and deletion timestamp of only a subset? Also File1 to File14 are assumed to be created and deleted earliest than File15 to File20 (fwe month to several years for some files)

Please give me your opinion only if you master unix file system and how files timestamps are managed.
The many the best.

Any way thank you very much for your time and help.