The date modified of a deleted file in a disk image is having a later date than the last system Log On date

I am analyzing a disk image for a forensic investigation and I see deleted files having a later date for last modified date than the last system log on date.
Does this means someone has created a raw image file and delete those files from the forensic image and then burn it to the disk again.
Can some one do this using a linux live CD.