twjolson…I have the same issue, but with different tools.
I carved the files with foremost and photorec (just to see if the carving tools where doing something weird), then used exiftool to pull out the metadata, and it shows the same +4 hr offset to the "expected result". The question I have to ask is, what is the timezone where the "suspect" floppy drive was located.
When I open the "magna carta" document, and view the properties, it says the create date is "09/16/2004 062000" Now I'm in NZST (UTC + 12), so subtract 12 hrs from the time and you get 09/15/2004 188000, which is exactly what exiftool showed, so exiftool is obtaining and displaying the UTC time.
This then leads me to think that the "220pm" expected answer is the local time of the evidence/offence location, which is UTC -4.
It would have helped knowing the timezone of the location of the Really Big Company.
Looking at
http//
It could be anywhere between Quebec and the western coastline of Chile!