How to tell if cloc...
 
Notifications
Clear all

How to tell if clock has changed

5 Posts
3 Users
0 Reactions
500 Views
(@mobileforensicswales)
Reputable Member
Joined: 17 years ago
Posts: 274
Topic starter  

I was wondering if anybody knows of any footprints that are left if the user changes their clock.

I understand that you can get sys event logs that say its been changed

Any feedback would be greatly appreciated


   
Quote
(@brede)
Trusted Member
Joined: 20 years ago
Posts: 64
 

Checking internet web browsing cache files and comparing it to data creation/ modify time and checking e-mail metadata (dates comparison).


   
ReplyQuote
(@mobileforensicswales)
Reputable Member
Joined: 17 years ago
Posts: 274
Topic starter  

Checking internet web browsing cache files and comparing it to data creation/ modify time and checking e-mail metadata (dates comparison).

I tried that, but good idea.

I've also tried looking at AVG scan logs to check for jumps
I'm pretty happy it hasn't been changed but wanted to make sure I'd covered all bases


   
ReplyQuote
keydet89
(@keydet89)
Famed Member
Joined: 21 years ago
Posts: 3568
 

Did you check the UserAssist keys to see if the user accessed the Date Time control panel applet?


   
ReplyQuote
(@mobileforensicswales)
Reputable Member
Joined: 17 years ago
Posts: 274
Topic starter  

Did you check the UserAssist keys to see if the user accessed the Date Time control panel applet?

That would be a good idea but that does not necessarily prove that they changed the time, just that they would have accessed the clock. Thats a very good point though, didn't realse recorrd of simply opening the time/date application was logged

Good Post D


   
ReplyQuote
Share: