A correlation method for establishing provenance of timestamps in digital evidence

Digital Investigation

Volumn 3, Issue SUPPL., 2006, Pages 98-107

  Schatz, Bradley ^a   Mohay, George ^a   Clark, Andrew ^a  

^a QUEENSLAND UNIVERSITY OF TECHNOLOGY   (Australia)

Author keywords

Digital evidence; Digital forensics; Event correlation; Reverse engineering; Timestamp interpretation

Indexed keywords

COMPUTER CRIME; COMPUTER SYSTEMS; REVERSE ENGINEERING; UNCERTAIN SYSTEMS; WEB BROWSERS;

DIGITAL EVIDENCE; DIGITAL FORENSICS; EVENT CORRELATION; TIMESTAMP INTERPRETATION;

CORRELATION METHODS;

EID: 33746009068     PISSN: 17422876     EISSN: None     Source Type: Journal    
DOI: 10.1016/j.diin.2006.06.009     Document Type: Article

References (13)

1. Boyd C., and Forster P. Time and date issues in forensic computing - a case study. Digital Investigation 1 (2004) 18-23
2. Gladyshev P., and Patel A. Formalising event time bounding in digital investigations. International Journal of Digital Evidence 4 2 (2005)
3. Jones K.J. Pasco - an Internet Explorer activity forensics analysis tool (2004). http://sourceforge.net/project/shownotes.php?group_id=78332&release_id=237810 (accessed April 2006)
4. Microsoft Corporation. How Windows keeps track of the date and time (2006). http://support.microsoft.com/?kbid=232488 (accessed April 2006)
5. Microsoft Corporation. The system clock may run fast when you use the ACPI power management timer as a high-resolution counter on Windows 2000-based, Windows XP-based, and Windows Server 2003-based computers (2006). http://support.microsoft.com/?kbid=821893 (accessed April 2006)
6. Microsoft Corporation. Microsoft products do not reflect Australian daylight saving time changes for the year 2006 (2006). http://support.microsoft.com/kb/909915 (accessed April 2006)
7. Mills D.L. Precision synchronization of computer network clocks. ACM Computer Communication Review 24 2 (1994) 28-43 (April 1994)
8. Mills D.L. A brief history of NTP time: confessions of an Internet timekeeper. ACM Computer Communications Review 33 2 (2003) 9-22 (April 2003)
9. Nolan R., O'Sullivan C., Branson J., and Waits C. First responders guide to computer forensics (2005), Software Engineering Institute, Carnegie Mellon University, Pittsburgh, PA
10. Sandhill Consulting. How Microsoft Windows NT 4.0 handles time (1998). http://folkworm.ceri.memphis.edu/ew-doc/PROGRAMMER/NTandTime.html (accessed April 2006)
11. Stevens M.W. Unification of relative time frames for digital forensics. Digital Investigation 1 (2004) 225-239
12. Thomas L.K. Reverse engineering index.dat (2003). http://www.latenighthacking.com/projects/2003/reIndexDat/ (accessed April 2006)
13. Weil C. Dynamic time & date stamp analysis. International Journal of Digital Evidence 1 2 (2002)