An instructor reported downloading assignment submission files and noted that for some of the students, the timestamps on the files were from several years ago. I've retrieved from a database query the contenthash of a student's assignment submission.
Indeed when I ls -l on the file on the filesystem, it is from 2015.
When I do a query for that content hash, I get two results for two different authors for two different years.
select id, contenthash, filepath, filename, userid, author, from_unixtime(timecreated), from_unixtime(timemodified) from mdl_files where contenthash = 'c529ae03492633e801a540cf5cabf9a2fff9f62a';
Is this cheating? What is this? How would this be done?