what does this "hotmail ct times" method consists in?
Hotmail emails have embedded date and time stamp. These are hotmail server times and represents the time that the page was requested from hotmail. If a user views the same email several times, each will have a different time stamp. The easiest way I've found to locate them is to search the text of the html page for "ct=". It's followed by a 10 digit unix date. Looks like this "ct=1137596620". By comparing that with the file's created time you can judge the accuracy of the system clock.
Another something to look for will be a tool that can be used to adjust MAC times.
Odds are good that they will have deleted the file and possibly the RECYCLER folder as well. Unless they have a wipe tool also installed or available to use, evidence of a tool used for adjusting MAC times will be found somewhere in the file table or currently unallocated/slack space.
It looks like you should have plenty of corroborating MAC times in order to build the case if the attorney really wants to go that route. They are afterall paying for your service. If they want to pay extra for you to support their "access time theory", then that seems to be their prerogative.
K