Windows and the BIOS clock

Thanks.

Okay. So how does one check the Windows OS date/time was accurate (had not been manipulated) when it was running prior to examination and when you only have a working copy of the drive? ?

you hope to the forensic gds for a few things

1. the clock was synchronizing to a time server (event logs will indicate the last time it synched and if it changed the clock)
2. they logged out of facebook at some point, because that gives a time in the URL when this incident occured, and the times should match if the clock is accurate.
3. cookies will occasionally od the same thing as above, give a time when the cookie was created, expired etc. depending on the recentcy (new word) of the drive, you can test cookies that have times in them to determine what you're working with (i think theyre in unix times, but you can use decode or time lord to figure out what the time refers to)

if anyone has any other suggestions im all ears, ive had similar situations and the above is what ive come up with

Thanks.

Okay. So how does one check the Windows OS date/time was accurate (had not been manipulated) when it was running prior to examination and when you only have a working copy of the drive? ?

I guess one has to have a "general idea" of the "amount" of "time shift" expected.

I mean are we talking of days, hours or minutes/seconds?

Was the supposed time/date shift backward or forward?

Which OS is it?

Check this thread also (only seemingly unrelated)
http//www.forensicfocus.com/Forums/viewtopic/t=9329/

jaclaz

Geesh… Make me feel so old.

I do remember, we could buy an expansion card with RTC.

I guess you are too young to remember the early (and good ol' wink ) days when you booted to an OS and you were prompted to input date and time (no hardware RTC)
http//www.os2museum.com/wp/?page_id=563
The original PC did not have one, and it was introduced in the XT as a (if I remember correctly rather costly) option and became "standard" on the AT
http//en.wikipedia.org/wiki/IBM_PC
http//www.philipstorr.id.au/pcbook/book4/hdxt.htm

jaclaz