I am trying to verify that at a particular time, the clock was accurate. My plan of attack is to compare the server modified field in the index.dat times with those of the file creation field and/or the file system file created times. My theory is that for dynamicly created pages, the server modified time should be current. And, I believe, this is what I see (although some are zeroed out)
The times are accurate in the minutes, however I am off in the hours. I think I am doing something wrong, but can't figure it out. For simplicity, I left the suspect time zone to UTC (It is in actually Central time, set to -5).
Page 1
Server Modified 11/07/05 50820pm (UTC)
File System 11/08/05 10812am
8 hours off
Page 2
Server Modified 11/07/05 50813 UTC
File System 11/08/05 10759am UTC
Again, 8 hours off
The only thing I can think of that might not be my fault is that the server sends the time as its own timezone, which the client then sets to UTC using its own timezone (since it may not know the servers timezone). I know I might be reaching there…
So, any insight would be greatly appreciated. For this, or any other strategies you may have to help me prove/disprove that the time was accurate at the time of the incident.
Terry