Files are created every 5 min. Timestamp is time recording begins. Recordings are of the stream. Not all traffic is captured, only what was selected at the time. Files in RED may not yet be available.