I've made an Encase image of a Win XP machine (Fat32, no NTFS). I've tried to parse the eventlogs but the results are almost empty (is this because of the Fat32 ?).
I've looked at the
SOFTWARE > Microsoft > Windows NT > current version > InstallDate
and have found some dates (time_t and time_t UTC)
However, the creation date of the Windows folder is one day earlier than the dates I found in "current version".
I have to find the date and time that the computer has been used for the last time. Of course I can see dates and time at the folders and files on the system. It's very important for me to find the RIGHT system time.
Is there a good and trusty solution to find the right system time of the Win XP on Fat32
thanks,
Stamitz
For the most part computers are horrible time keepers, which is why they have to sync with a time server. Why do you think the computer has to have the right time? When you seized the computer what was the time according to the BIOS in relation to the "actual" time? Did the BIOS time match the Windows time?
I checked the bios of the pc and it had the right time (according to the clock). I also checked the timezone of Windows (with encase script > system registry hive) and that was also right. I guess I just have to trust the dates and times of the files (last written, last accessed etc.) now.
Yes, I think you can say that computers are horrible time keepers -)
Hi,
If you're not quite ready to trust the system clock have a look at the setupapi.log files to see if the dates of events appear out of order.
Are there any server based dates and times that could be compared to system clock dates and times? i.e. chat logs, emails etc?
Determining how much you can trust the system clock will at least let you know where you need to focus your problem solving skills.
Steve