Quantcast
Channel: Forensic Focus Forums - Recent Topics
Viewing all articles
Browse latest Browse all 20107

Forensic Software: data string w timestamp info

$
0
0
Here is (perhaps) another helpful report from my tool - Base Time Time: 2008-06-16 18:49:45 TimeZone: (UTC) Coordinated Universal Time Ambiguous? False Time 1 Time: 2008-06-16 13:49:45 TimeZone: (UTC-05:00) Eastern Time (US & Canada) Ambiguous? False Difference to base time: 1 hrs 0 mins and 0 secs behind Time 2 Time: 2008-06-16 13:49:45 TimeZone: (UTC-06:00) Central Time (US & Canada) Ambiguous? False Difference to base time: Same Time Difference to Time 1: 1 hrs 0 mins and 0 secs ahead Time 3 Time: 2008-06-16 13:49:45 TimeZone: (UTC-06:00) Guadalajara, Mexico City, Monterrey Ambiguous? False Difference to base time: Same Time Difference to Time 1: 1 hrs 0 mins and 0 secs ahead Difference to Time 2: Same Time Showing that EST with DST applied is not an appropriate Local time but in this example there are two timezones that are (there are in fact, 4 I believe). Of course the computer concerned may not have had DST applied at the time the record was applied (as suggested by the registry information supplied) or the user was in a different time zone or the software concerned didn't care about DST... Going back to the original question I would say it would be foolhardy to make any assumptions about local time from this one artifact. Try and stand in a court and make a definitive statement without absolute and unequivocal knowledge is foolhardy at best and tantamount to suicidal at worst.

Viewing all articles
Browse latest Browse all 20107

Trending Articles