±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 36077
New Yesterday: 0 Visitors: 179

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

Checking Bios time yes or no

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Page Previous  1, 2, 3, 4 
  

Rich2005
Senior Member
 

Re: Checking Bios time yes or no

Post Posted: May 23, 19 11:15

- fissa
An interesting topic. I think it will keep me busy untill the end of times ^^


Indeed it will. Dates and times on digital devices are an absolute minefield.  
 
  

pbeardmore
Senior Member
 

Re: Checking Bios time yes or no

Post Posted: May 23, 19 12:44

Another quick point: sometimes we collect evidence not because we personally will reference it as part of the case but because it maybe in the interests of the wider investigation.

As we have seen just in this thread, there is variation of opinion on how useful the BIOS time is. Just because the initial examiner does not think it has any value, perhaps they should record it as a matter of procedure, just in case another expert further down the line does indeed want to infer or interpret something from that information. By deciding not to gather this data during the initial exam, are we effectively making the decision on behalf of any future experts?

We don't do this with a forensic image (obviously, experts get to see everything) so perhaps the same should be said re the BIOS time? Just a thought....  
 
  

Rich2005
Senior Member
 

Re: Checking Bios time yes or no

Post Posted: May 23, 19 13:59

- pbeardmore
Another quick point: sometimes we collect evidence not because we personally will reference it as part of the case but because it maybe in the interests of the wider investigation.

As we have seen just in this thread, there is variation of opinion on how useful the BIOS time is. Just because the initial examiner does not think it has any value, perhaps they should record it as a matter of procedure, just in case another expert further down the line does indeed want to infer or interpret something from that information. By deciding not to gather this data during the initial exam, are we effectively making the decision on behalf of any future experts?

We don't do this with a forensic image (obviously, experts get to see everything) so perhaps the same should be said re the BIOS time? Just a thought....


It's a valid point.
Although, continuining to play devil's advocate, I suppose the counter to that might be that we do this all the time in some ways. Perhaps, for example, by handling exhibits that it might turn out an expert later wanted to fingerprint, and the original investigator/officer didn't. Or perhaps it's live memory, which I imagine not everyone captures as a matter of course (obviously in certain investigations that's going to be more likely than others).
Perhaps, if practical, it makes most sense to record the value in notes (for posterity), and not highlight/report it unless there's good reason to raise its prominence, in a more detailed elaboration of dates/times.  
 

Page 4 of 4
Page Previous  1, 2, 3, 4