While reviewing DLP discover incidents, you observe incidents are generated for a file with older date of modification than date of creation of the file.
DLP 15.8 and above.
This happens due to how windows explorer handles date of a creation and date modified of a file.
If you move a file from one location to another the date of creation changes to the current date however the date modified remains the same (older date).
Due to this behavior files can have date modified older than date created.