Notifications
Clear all

System Time

9 Posts
5 Users
0 Likes
414 Views
christop007
(@christop007)
Posts: 10
Active Member
Topic starter
 

hi everyone and thank you for looking at my posting.

i have an inquire that hopefully someone will be able to help me with, as i am all out of ideas

how would i get the system time setting from a computer if the computers its self was sealed.

i thought that i would be able to boot up the system and then go directly into the bios and get the setting from the bios before the system started to do it's checks but then i thought that if i missed the time span allowed to enter the bios then effectively i would be tampering with evidence, i cant put a write blocker on to the disk as the units self is sealed and i cant get to the hard disk.

i had another idea to break the seal with a compentent person present and get the system time that way form the from the RTC.

any help on this matter would be really appreciated.

thanks again
christop007

 
Posted : 28/03/2006 3:04 am
psu89
(@psu89)
Posts: 118
Estimable Member
 

Not sure if this is true of all systems but won't and Intel system halt during POST if there is no keyboard detected? If so unplug the keyboard.

 
Posted : 28/03/2006 3:09 am
(@psycko)
Posts: 16
Active Member
 

What about a boot DOS floppy disk in the drive ?
Usually the floppy drive is the first media to boot in the Bios
And a CD rom with Helix or a linux live cd in the cdrom drive

But the most difficult is to be be sure that it is not the hard drive that starts
in first and to be the fastest to press the bios key roll

Psy

 
Posted : 28/03/2006 3:25 am
christop007
(@christop007)
Posts: 10
Active Member
Topic starter
 

thanks for the response to the intitial question

i am not sure about booting from a floopy can anyone advise if this would be classed as tampering with evidence, or if i get to into the bios and check the system time and turn the computer off woulld this be classed as tampering with evidence, its more about the continuity of evidence that i am concern with
i will also do more research about unplugging the key board but i need to be sure before i attempt this as if i boot i dont even have the option to go into bios.

thanks again
christop007

 
Posted : 28/03/2006 6:36 am
Jamie
(@jamie)
Posts: 1288
Moderator
 

Are you able to examine the computer visually for any clues (i.e. make, model, serial no. etc) which might allow you to research the correct procedure for entering the BIOS during boot up, prior to attempting to do so?

Jamie

 
Posted : 28/03/2006 7:26 am
christop007
(@christop007)
Posts: 10
Active Member
Topic starter
 

hi jamie
i am a not sure if i am allowed to enter the bios at all as i think this would be tampering with evidence can anyone advise
christop007

 
Posted : 28/03/2006 7:35 am
Jamie
(@jamie)
Posts: 1288
Moderator
 

It depends on the case, of course, and you should seek appropriate professional advice from someone well versed in the case as to the best course of action for you to take. That said, if the case does call for you to enter the BIOS, you attempt to do so in a sensible fashion and document your actions responsibly then it may well be an appropriate course of action to take.

Jamie

 
Posted : 28/03/2006 8:03 am
(@gmarshall139)
Posts: 378
Reputable Member
 

There are other ways to verify system time. Most involve embedded dates and times within html pages in the internet cache. Hotmail messages for instance have embedded server dates within them. Search the text of that message for "ct=". It's followed by a 10 digit unix date. Looks like this "ct=1137596620". By comparing that with the file's created time you can judge the accuracy of the system clock.

There are a lot of ways to do it. Limited only by your imagination really. If you see weather radar pictures they will have a date and time right on the image. It wont be exact, but most of those pictures are updated every 3 or 6 hours.

 
Posted : 28/03/2006 6:39 pm
christop007
(@christop007)
Posts: 10
Active Member
Topic starter
 

hi guys

thanks for the advice i have a little bit more research to do on different area and i will let you know how i get on

thanks again its most appreciated

christop007

 
Posted : 29/03/2006 12:33 am
Share: