Compiling evidence boils down to a matter of time

IT needs a consistent approach to creating timestamps for forensic computing. Whenever evidence about what is found on a hard drive is put before courts, the lawyers usually fail to ask the right question. They want to know whether certain files are on there. They should be asking “How did it get there?” and “When did it get there?” Accurate time determination is a crucial part of forensic computing evidence…

More (iTnews Australia)