Yep just enough to wake up people there, anyway, for their skills, showing them a full forensic analysis in real time, would have had the same effect (they didn't even ask anything to prove those were from the same systems), but would have way complex and, in this way you leave the enemy with a nothing burger, as, for what they know, Ron may be even just dicking around with his own hard drive

but a real forensic procedure, if triggered, would prove everything as needed

btw, to have 3 point in time (images), people need to ask themselves how, they had them... i'd say same source as the pcap :)