Time and Date probl...
 
Notifications
Clear all

Time and Date problems

4 Posts
2 Users
0 Likes
361 Views
nickfx
(@nickfx)
Posts: 131
Estimable Member
Topic starter
 

Im sure like many of you I get my brain in a twist with Time and Date issues and I'm currently stuck!

Fraud case, we are looking at times that documents were accessed and likely sent to a usbkey and deleted. Anyway…

Client sends a screen dump from Windows explorer showing the last modified dates of shortcuts from the 'Recent' folder. For arguements sake the doc in question has a time of 1115am

Yesterday I recieved the actual notebook and used the Linux based Penguin Sleuth Kit CDROM to have a look around. The same files in the 'Recent' folder show a time exactly 1 hour later, 1215. All files were created in the last month so no Summer Time change and the system clock of the notebook is correct.

So - why is the screen dump from the client different from the times I can see?

Nick

 
Posted : 20/07/2005 1:53 pm
keydet89
(@keydet89)
Posts: 3568
Famed Member
 

What are the time zone settings on the laptop, as opposed to what your Sleuth kit distro says?

H. Carvey
"Windows Forensics and Incident Recovery"
http//www.windows-ir.com
http//windowsir.blogspot.com

 
Posted : 20/07/2005 2:11 pm
nickfx
(@nickfx)
Posts: 131
Estimable Member
Topic starter
 

Thats a good point, I'm away from the office at the moment and will post again in a while, thanks for replying so quickly.

Nick

 
Posted : 20/07/2005 2:26 pm
nickfx
(@nickfx)
Posts: 131
Estimable Member
Topic starter
 

Hello Mr Carvey.

As is often the case with these things it was staring me in the face all the time and as you rightly suggested there was a difference in times. I'm still left with a slight oddity but I may post about that later.

I've just finished defending a case where it all hung on times and dates and thankfully got a not guilty verdict. I think I'm all 'timed and dated' out!

Thanks for the pointer!

Nick

 
Posted : 21/07/2005 2:53 pm
Share: