±Forensic Focus Partners
|New Today: 0||Overall: 35407|
|New Yesterday: 7||Visitors: 206|
Back to top Skip to content Skip to menu Back to top Back to main Skip to menu
Verifying date/time settings when BIOS is unaccessible
Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)Page Previous 1, 2
This might help....whilst checking the RTC of the machine should be done in every case, remember that really that time is only valid for the time you checked it....you can often be unable to state the accuracy of the RTC at any given point in the past. A little trick I use often to verify the time/date at a certain point in time is to look for any files around the time I need that might contain an external time stamp - most, obviously, from an Internet server...Google cookies are excellent for this as they contain a UNIX time stamp [from a Google server] which can be decoded and compared with the file created time/date [from the local machine]. You can often find a UNIX time stamp in cookies and sometimes embedded in web pages.