Timeline analysis can bite you - there will be events that have a timestamp during the time the device was powered off. So be careful just assuming that a timestamp means the computer was on.
↧