Time and Date problems
Im sure like many of you I get my brain in a twist with Time and Date issues and I'm currently stuck!
Fraud case, we are looking at times that documents were accessed and likely sent to a usbkey and deleted. Anyway…
Client sends a screen dump from Windows explorer showing the last modified dates of shortcuts from the 'Recent' folder. For arguements sake the doc in question has a time of 1115am
Yesterday I recieved the actual notebook and used the Linux based Penguin Sleuth Kit CDROM to have a look around. The same files in the 'Recent' folder show a time exactly 1 hour later, 1215. All files were created in the last month so no Summer Time change and the system clock of the notebook is correct.
So - why is the screen dump from the client different from the times I can see?
Thats a good point, I'm away from the office at the moment and will post again in a while, thanks for replying so quickly.
Hello Mr Carvey.
As is often the case with these things it was staring me in the face all the time and as you rightly suggested there was a difference in times. I'm still left with a slight oddity but I may post about that later.
I've just finished defending a case where it all hung on times and dates and thankfully got a not guilty verdict. I think I'm all 'timed and dated' out!
Thanks for the pointer!