Time and Date probl...
 
Notifications
Clear all

Time and Date problems  

  RSS
nickfx
(@nickfx)
Active Member

Im sure like many of you I get my brain in a twist with Time and Date issues and I'm currently stuck!

Fraud case, we are looking at times that documents were accessed and likely sent to a usbkey and deleted. Anyway…

Client sends a screen dump from Windows explorer showing the last modified dates of shortcuts from the 'Recent' folder. For arguements sake the doc in question has a time of 1115am

Yesterday I recieved the actual notebook and used the Linux based Penguin Sleuth Kit CDROM to have a look around. The same files in the 'Recent' folder show a time exactly 1 hour later, 1215. All files were created in the last month so no Summer Time change and the system clock of the notebook is correct.

So - why is the screen dump from the client different from the times I can see?

Nick

Quote
Posted : 20/07/2005 2:53 pm
keydet89
(@keydet89)
Community Legend

What are the time zone settings on the laptop, as opposed to what your Sleuth kit distro says?

H. Carvey
"Windows Forensics and Incident Recovery"
http//www.windows-ir.com
http//windowsir.blogspot.com

ReplyQuote
Posted : 20/07/2005 3:11 pm
nickfx
(@nickfx)
Active Member

Thats a good point, I'm away from the office at the moment and will post again in a while, thanks for replying so quickly.

Nick

ReplyQuote
Posted : 20/07/2005 3:26 pm
nickfx
(@nickfx)
Active Member

Hello Mr Carvey.

As is often the case with these things it was staring me in the face all the time and as you rightly suggested there was a difference in times. I'm still left with a slight oddity but I may post about that later.

I've just finished defending a case where it all hung on times and dates and thankfully got a not guilty verdict. I think I'm all 'timed and dated' out!

Thanks for the pointer!

Nick

ReplyQuote
Posted : 21/07/2005 3:53 pm
Share: