Windows and the BIOS clock

in my testing ive found that yes they are linked. if i change the time on the windows clock (even if it's just changing the timezone) then the bios clock will change

im not sure if there's a way to make them different

In my experience they are linked, but Windows has its own offset from the BIOS clock, regarding of what time zone the Windows computer is located in.

You can have a look at the registry, in HKEY_LOCAL_MACHINE\SYSTEM\Controlset001\Control\TimeZoneInformation; which will give you more information of what time zone the computer is set to use. If you have a imaged computer, you will usually find this information in the file Windows\System32\config\SYSTEM.

Just for the record
http//blogs.msdn.com/b/oldnewthing/archive/2004/09/02/224672.aspx
http//www.cl.cam.ac.uk/~mgk25/mswish/ut-rtc.html

jaclaz

It's amazing what a little research can show you…great find, jaclaz, and thanks for sharing.

Thanks guys.

So if one takes an image of the drive and mounts that image to another PC then the OS/system time will be that of the PC (or PC's BIOS) to which the drive is mounted?

Thanks guys.

So if one takes an image of the drive and mounts that image to another PC then the OS/system time will be that of the PC (or PC's BIOS) to which the drive is mounted?

Date/time on your examination workstation should have no affect on the forensic image other than possibly your local timezone settings being applied to date/time stamps which are stored in GMT.

Just for the record
http//blogs.msdn.com/b/oldnewthing/archive/2004/09/02/224672.aspx
http//www.cl.cam.ac.uk/~mgk25/mswish/ut-rtc.html

jaclaz

That second link is very interesting reading.

Date/time on your examination workstation should have no affect on the forensic image other than possibly your local timezone settings being applied to date/time stamps which are stored in GMT.

Thanks.

What if one boots from the imaged drive? Doesn't the OS pick up the current date/time from the examination workstation hardware/BIOS clock?

What if one boots from the imaged drive? Doesn't the OS pick up the current date/time from the examination workstation hardware/BIOS clock?

Sure ) , BUT at the same time you will have in 99.99% of cases completely voided the integrity of the imaged drive by actually booting from it. 😯

When an OS boots it takes a "base" time from the actual hardware (real or virtual) RTC (or Real Time Clock) it is booted on (and this suddenly explains why PC's do have an internal battery)
http//en.wikipedia.org/wiki/Real_time_clock

I guess you are too young to remember the early (and good ol' wink ) days when you booted to an OS and you were prompted to input date and time (no hardware RTC)
http//www.os2museum.com/wp/?page_id=563
The original PC did not have one, and it was introduced in the XT as a (if I remember correctly rather costly) option and became "standard" on the AT
http//en.wikipedia.org/wiki/IBM_PC
http//www.philipstorr.id.au/pcbook/book4/hdxt.htm

jaclaz