±Forensic Focus Partners

Become an advertising partner

±Your Account


Forgotten password/username?

Site Members:

New Today: 0 Overall: 36583
New Yesterday: 6 Visitors: 575

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

Time and Date problems

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts

Senior Member

Time and Date problems

Post Posted: Jul 20, 05 13:53

Im sure like many of you I get my brain in a twist with Time and Date issues and I'm currently stuck!

Fraud case, we are looking at times that documents were accessed and likely sent to a usbkey and deleted. Anyway...

Client sends a screen dump from Windows explorer showing the last modified dates of shortcuts from the 'Recent' folder. For arguements sake the doc in question has a time of 11:15am

Yesterday I recieved the actual notebook and used the Linux based Penguin Sleuth Kit CDROM to have a look around. The same files in the 'Recent' folder show a time exactly 1 hour later, 12:15. All files were created in the last month so no Summer Time change and the system clock of the notebook is correct.

So - why is the screen dump from the client different from the times I can see?


Senior Member

Re: Time and Date problems

Post Posted: Jul 20, 05 14:11

What are the time zone settings on the laptop, as opposed to what your Sleuth kit distro says?

H. Carvey
"Windows Forensics and Incident Recovery"

Senior Member

Re: Time and Date problems

Post Posted: Jul 20, 05 14:26

Thats a good point, I'm away from the office at the moment and will post again in a while, thanks for replying so quickly.


Senior Member

Re: Time and Date problems

Post Posted: Jul 21, 05 14:53

Hello Mr Carvey.

As is often the case with these things it was staring me in the face all the time and as you rightly suggested there was a difference in times. I'm still left with a slight oddity but I may post about that later.

I've just finished defending a case where it all hung on times and dates and thankfully got a not guilty verdict. I think I'm all 'timed and dated' out!

Thanks for the pointer!


Page 1 of 1