±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 35279
New Yesterday: 3 Visitors: 222

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Webinars

How to tell if clock has changed

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
 
  

mobileforensicswales
Senior Member
 

How to tell if clock has changed

Post Posted: Sep 08, 08 07:27

I was wondering if anybody knows of any footprints that are left if the user changes their clock.

I understand that you can get sys event logs that say its been changed

Any feedback would be greatly appreciated  
 
  

brede
Senior Member
 

Re: How to tell if clock has changed

Post Posted: Sep 08, 08 07:57

Checking internet web browsing cache files and comparing it to data creation/ modify time and checking e-mail metadata (dates comparison).  
 
  

mobileforensicswales
Senior Member
 

Re: How to tell if clock has changed

Post Posted: Sep 08, 08 08:03

- brede
Checking internet web browsing cache files and comparing it to data creation/ modify time and checking e-mail metadata (dates comparison).

I tried that, but good idea.

I've also tried looking at AVG scan logs to check for jumps
I'm pretty happy it hasn't been changed but wanted to make sure I'd covered all bases  
 
  

keydet89
Senior Member
 

Re: How to tell if clock has changed

Post Posted: Sep 08, 08 09:45

Did you check the UserAssist keys to see if the user accessed the Date Time control panel applet?  
 
  

mobileforensicswales
Senior Member
 

Re: How to tell if clock has changed

Post Posted: Sep 08, 08 09:54

- keydet89
Did you check the UserAssist keys to see if the user accessed the Date Time control panel applet?

That would be a good idea but that does not necessarily prove that they changed the time, just that they would have accessed the clock. Thats a very good point though, didn't realse recorrd of simply opening the time/date application was logged

Good Post Very Happy  
 

Page 1 of 1