I can believe the files talked about earlier in the state's case (several accessed within seconds of each other after 2:00 a.m. (on Feb 8th?) were from a scan, many computers have scan default time set at 2:00 or 3:00 in the morning and will run if the computer is left on.
I have a bit of doubt that a scan would be set to run just before 7:00 in the evening, when the owner is more likely to be home and apt to need the computer for business, entertainment, etc. That could also have been checked, whatever on board security programs are installed or Windows maintenance will all have an area for auto scan times that can be verified.