Computer Forensics - sometimes it’s all about timing

by Sam Raincock

When a crime happens, the time of the events may be critical to the legal case. However, how are these times established? Is it the time alleged by the witness? When the CCTV system captured the image? When the computer said the person left their home? When the satellite navigation system recorded they arrived? When the mobile was cell sited in the area? Or is it all of the above?

There is an abundance of studies addressing the accuracy of witness evidence. However, what about the accuracy of times provided by witnesses?

- I know it was 13:05 because I looked at my watch

- I walked past the newsagents and it was open so it must have been after 13:30

- I had just had my lunch, watched the news and left at 13:40

Without looking at your watch/clock (or computer), what time is it? What time does your watch/clock say? What time is it really?

Just like humans, digital devices may tell the incorrect time. In fact, they often do. Hence, when analysing events, it is crucial to compare like with like, otherwise the chronology may become scrambled and the evidence contradictory. In this article, I will discuss the issue of accurate digital device time and some basic techniques to assist in questioning and approximating the correct timings...

Read more at http://www.forensicfocus.com/sam-raincock