±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 36783
New Yesterday: 0 Visitors: 124

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

System Time

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Page 1, 2  Next 
  

christop007
Member
 

System Time

Post Posted: Mar 28, 06 03:04

hi everyone and thank you for looking at my posting.

i have an inquire that hopefully someone will be able to help me with, as i am all out of ideas

how would i get the system time setting from a computer if the computers its self was sealed.

i thought that i would be able to boot up the system and then go directly into the bios and get the setting from the bios before the system started to do it's checks but then i thought that if i missed the time span allowed to enter the bios then effectively i would be tampering with evidence, i cant put a write blocker on to the disk as the units self is sealed and i cant get to the hard disk.

i had another idea to break the seal with a compentent person present and get the system time that way form the from the RTC.

any help on this matter would be really appreciated.

thanks again
christop007  
 
  

psu89
Senior Member
 

Re: System Time

Post Posted: Mar 28, 06 03:09

Not sure if this is true of all systems but won't and Intel system halt during POST if there is no keyboard detected? If so unplug the keyboard.  
 
  

psycko
Member
 

Re: System Time

Post Posted: Mar 28, 06 03:25

What about a boot DOS floppy disk in the drive ?
Usually the floppy drive is the first media to boot in the Bios
And a CD rom with Helix or a linux live cd in the cdrom drive

But the most difficult is to be be sure that it is not the hard drive that starts
in first and to be the fastest to press the bios key Rolling Eyes

Psy  
 
  

christop007
Member
 

Re: System Time

Post Posted: Mar 28, 06 06:36

thanks for the response to the intitial question

i am not sure about booting from a floopy can anyone advise if this would be classed as tampering with evidence, or if i get to into the bios and check the system time and turn the computer off woulld this be classed as tampering with evidence, its more about the continuity of evidence that i am concern with
i will also do more research about unplugging the key board but i need to be sure before i attempt this as if i boot i dont even have the option to go into bios.

thanks again
christop007  
 
  

jamie
Site Admin
 

Re: System Time

Post Posted: Mar 28, 06 07:26

Are you able to examine the computer visually for any clues (i.e. make, model, serial no. etc) which might allow you to research the correct procedure for entering the BIOS during boot up, prior to attempting to do so?

Jamie
_________________
Jamie Morris
Forensic Focus
Web: www.forensicfocus.com
Twitter: twitter.com/ForensicFocus
Facebook: www.facebook.com/forensicfocus 
 
  

christop007
Member
 

Re: System Time

Post Posted: Mar 28, 06 07:35

hi jamie
i am a not sure if i am allowed to enter the bios at all as i think this would be tampering with evidence can anyone advise
christop007  
 
  

jamie
Site Admin
 

Re: System Time

Post Posted: Mar 28, 06 08:03

It depends on the case, of course, and you should seek appropriate professional advice from someone well versed in the case as to the best course of action for you to take. That said, if the case does call for you to enter the BIOS, you attempt to do so in a sensible fashion and document your actions responsibly then it may well be an appropriate course of action to take.

Jamie
_________________
Jamie Morris
Forensic Focus
Web: www.forensicfocus.com
Twitter: twitter.com/ForensicFocus
Facebook: www.facebook.com/forensicfocus 
 

Page 1 of 2
Page 1, 2  Next