Ms. Raincock's article is a good read, overall.
I was struck by her section on telephone time, particularly her statement
Mobile telephones also potentially suffer from time accuracy problems since the handset date and time is set and can be altered by a user.
Is this a UK-specific issue? It's been my experience that mobile handsets in the US get their time from the carrier, whose time is very accurate due to interstate tariffs and the "need" for precise billing.
It's been a while since i've done phones but i seem to remember that items such as the call logs would be based on the handset date and time, and items such as the received text messages would come from the network and therefore be more reliable.
Time zones do confuse this much more. A server might be in one time zone and the client in another. Furthermore, daylight savings add much more confusion to this, especially due to the rather recent change to it in the US. Some devices / computer obey the old rules, some the new ones.
These issues are some f the most complex ones to properly explain.
Nik, absolutely. Cases with time zone changes hurt the grey matter and if you are like me, usually involve me constant checking/paranoia to make sure I've got it right. I think it is very challenging to attempt to explain such concepts so that a legal professional fully appreciate what they mean and why the differences are present. If you add in the fact the time may be offset in each zone too…..boy it becomes tricky. This is often seen in telecoms too, where handsets will be in their own time frames and can also be in different time zones too.
Kind regards
Rich2005
It's been a while since i've done phones but i seem to remember that items such as the call logs would be based on the handset date and time, and items such as the received text messages would come from the network and therefore be more reliable.
____________________________________________
That's exactly as I understand it too. Also, a way of checking the accuracy of a handsets time (in the UK), is to have a radio controlled clock that updates via the MSF time signal transmitted from Anthorn. This means that you can see the difference in actual time for the handset. Of course, though, this is only useful at the time of the handsets examination as you would not know how fast or slow the handsets clock was running and if it was accurate say 3 or 4 weeks ago….
I was recently cross examined in court by a QC and queried by the presiding Judge because they wanted to know if the dates & times in my report should be adjusted because the computer on which my evidence was found had a PST timezone setting & had been used in London.
I produced my evidence in GMT, as is my standard practice, and as the activities that were relevant to the case were relative to each other, I thought this was the simpliest way to explain my findings.
The BIOS clock had been found to be accurate upon receipt and therefore I assumed that the OS would take this time as a given and no adjustment would be made as long as no changes had been made to it's timezone; i.e. a computer in a PST timezone with an accurate BIOS clock would carry on as normal if the date was not a significant one in respect to daylight saving being applied.
Of course, I could have examined a clone of the computer to be sure but this is a time consuming task.
In the end the court accepted that the 'relativeness' of the activities was more important than if they occured at 10pm or 1pm and the court also accepted the possibility that the user could have been blissfully unaware of the PST setting and had simply adjusted the time to reflect local time.
In the end, the learned gentlemen appeared to appreciate that I had produced my evidence in GMT in order to simplify matters!
To be frank, I am still not 100% sure if I should have adjusted my EnCase case file to PST or not!
I was recently cross examined in court by a QC and queried by the presiding Judge because they wanted to know if the dates & times in my report should be adjusted because the computer on which my evidence was found had a PST timezone setting & had been used in London.
I produced my evidence in GMT, as is my standard practice, and as the activities that were relevant to the case were relative to each other, I thought this was the simpliest way to explain my findings.
The BIOS clock had been found to be accurate upon receipt and therefore I assumed that the OS would take this time as a given and no adjustment would be made as long as no changes had been made to it's timezone; i.e. a computer in a PST timezone with an accurate BIOS clock would carry on as normal if the date was not a significant one in respect to daylight saving being applied.
Of course, I could have examined a clone of the computer to be sure but this is a time consuming task.
In the end the court accepted that the 'relativeness' of the activities was more important than if they occured at 10pm or 1pm and the court also accepted the possibility that the user could have been blissfully unaware of the PST setting and had simply adjusted the time to reflect local time.In the end, the learned gentlemen appeared to appreciate that I had produced my evidence in GMT in order to simplify matters!
To be frank, I am still not 100% sure if I should have adjusted my EnCase case file to PST or not!
Thanks for sharing your experience Neddy. Verry app to mobile phone clocks.
Interesting to see the Judge quizzing on the issue of the device clock and the timestamps non-absolute non-relative value to the evidence overall, substantiated by the uncertainty of what human intervention occurred with the device clock.