Windows and the BIO...
 
Notifications
Clear all

Windows and the BIOS clock

14 Posts
8 Users
0 Likes
2,191 Views
(@firewire)
Posts: 14
Active Member
Topic starter
 

Hi, is the Windows OS (XP in this case) clock interlinked with the BIOS/hardware clock? If one manipulates the OS clock does it effect the BIOS/hardware clock and vice versa?

Will there never be any difference between the BIOS clock and OS clock on the task bar?

Massive thanks.

 
Posted : 21/12/2012 1:50 am
(@randomaccess)
Posts: 385
Reputable Member
 

in my testing ive found that yes they are linked. if i change the time on the windows clock (even if it's just changing the timezone) then the bios clock will change

im not sure if there's a way to make them different

 
Posted : 21/12/2012 2:02 am
(@ivarfr)
Posts: 1
New Member
 

In my experience they are linked, but Windows has its own offset from the BIOS clock, regarding of what time zone the Windows computer is located in.

You can have a look at the registry, in HKEY_LOCAL_MACHINE\SYSTEM\Controlset001\Control\TimeZoneInformation; which will give you more information of what time zone the computer is set to use. If you have a imaged computer, you will usually find this information in the file Windows\System32\config\SYSTEM.

 
Posted : 21/12/2012 2:17 pm
jaclaz
(@jaclaz)
Posts: 5133
Illustrious Member
 

Just for the record
http//blogs.msdn.com/b/oldnewthing/archive/2004/09/02/224672.aspx
http//www.cl.cam.ac.uk/~mgk25/mswish/ut-rtc.html

jaclaz

 
Posted : 21/12/2012 5:20 pm
keydet89
(@keydet89)
Posts: 3568
Famed Member
 

It's amazing what a little research can show you…great find, jaclaz, and thanks for sharing.

 
Posted : 21/12/2012 7:14 pm
(@firewire)
Posts: 14
Active Member
Topic starter
 

Thanks guys.

So if one takes an image of the drive and mounts that image to another PC then the OS/system time will be that of the PC (or PC's BIOS) to which the drive is mounted?

 
Posted : 30/12/2012 7:20 am
(@patrick4n6)
Posts: 650
Honorable Member
 

Thanks guys.

So if one takes an image of the drive and mounts that image to another PC then the OS/system time will be that of the PC (or PC's BIOS) to which the drive is mounted?

Date/time on your examination workstation should have no affect on the forensic image other than possibly your local timezone settings being applied to date/time stamps which are stored in GMT.

 
Posted : 30/12/2012 12:46 pm
Beetle
(@beetle)
Posts: 318
Reputable Member
 

Just for the record
http//blogs.msdn.com/b/oldnewthing/archive/2004/09/02/224672.aspx
http//www.cl.cam.ac.uk/~mgk25/mswish/ut-rtc.html

jaclaz

That second link is very interesting reading.

 
Posted : 30/12/2012 7:31 pm
(@firewire)
Posts: 14
Active Member
Topic starter
 

Date/time on your examination workstation should have no affect on the forensic image other than possibly your local timezone settings being applied to date/time stamps which are stored in GMT.

Thanks.

What if one boots from the imaged drive? Doesn't the OS pick up the current date/time from the examination workstation hardware/BIOS clock?

 
Posted : 30/12/2012 9:01 pm
jaclaz
(@jaclaz)
Posts: 5133
Illustrious Member
 

What if one boots from the imaged drive? Doesn't the OS pick up the current date/time from the examination workstation hardware/BIOS clock?

Sure ) , BUT at the same time you will have in 99.99% of cases completely voided the integrity of the imaged drive by actually booting from it. 😯

When an OS boots it takes a "base" time from the actual hardware (real or virtual) RTC (or Real Time Clock) it is booted on (and this suddenly explains why PC's do have an internal battery)
http//en.wikipedia.org/wiki/Real_time_clock

I guess you are too young to remember the early (and good ol' wink ) days when you booted to an OS and you were prompted to input date and time (no hardware RTC)
http//www.os2museum.com/wp/?page_id=563
The original PC did not have one, and it was introduced in the XT as a (if I remember correctly rather costly) option and became "standard" on the AT
http//en.wikipedia.org/wiki/IBM_PC
http//www.philipstorr.id.au/pcbook/book4/hdxt.htm

jaclaz

 
Posted : 31/12/2012 12:33 am
Page 1 / 2
Share: