I was wondering if anybody knows of any footprints that are left if the user changes their clock.
I understand that you can get sys event logs that say its been changed
Any feedback would be greatly appreciated
Checking internet web browsing cache files and comparing it to data creation/ modify time and checking e-mail metadata (dates comparison).
Checking internet web browsing cache files and comparing it to data creation/ modify time and checking e-mail metadata (dates comparison).
I tried that, but good idea.
I've also tried looking at AVG scan logs to check for jumps
I'm pretty happy it hasn't been changed but wanted to make sure I'd covered all bases
Did you check the UserAssist keys to see if the user accessed the Date Time control panel applet?
Did you check the UserAssist keys to see if the user accessed the Date Time control panel applet?
That would be a good idea but that does not necessarily prove that they changed the time, just that they would have accessed the clock. Thats a very good point though, didn't realse recorrd of simply opening the time/date application was logged
Good Post D