A correlation method for establishing provenance of timestamps in digital evidence

Digital Forensic Research Workshop 2006

Volumn , Issue , 2006, Pages

  Schatz, Bradley ^a   Mohay, George ^a   Clark, Andrew ^a  

^a QUEENSLAND UNIVERSITY OF TECHNOLOGY   (Australia)

Author keywords

Digital evidence; Digital forensics; Event correlation; Reverse engineering; Timestamp interpretation

Indexed keywords

CLOCK SKEWS; DIGITAL EVIDENCE; DIGITAL FORENSIC; ENVIRONMENTAL FACTORS; EVENT CORRELATION; FORENSIC INVESTIGATION; LOCAL TIME; TEMPORAL BEHAVIOUR; TIME STAMPS; TIME-STAMP;

ELECTRONIC CRIME COUNTERMEASURES; HUMAN COMPUTER INTERACTION; REVERSE ENGINEERING;

CLOCKS;

EID: 84864599047     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1016/j.diin.2006.06.009     Document Type: Conference Paper

References (13)

1. Boyd C, Forster P. Time and date issues in forensic computing - a case study. Digital Investigation 2004;1:18-23.
2. Gladyshev P, Patel A. Formalising event time bounding in digital investigations. International Journal of Digital Evidence 2005; 4(2).
3. Jones KJ. Pasco - an Internet Explorer activity forensics analysis tool, http://sourceforge.net/project/shownotes.php?group-id=78332&release-id= 237810; 2004 (accessed April 2006).
4. Microsoft Corporation. How Windows keeps track of the date and time, http://support.microsoft.com/?kbid=232488; 2006a (accessed April 2006).
5. Microsoft Corporation. The system clock may run fast when you use the ACPI power management timer as a high-resolution counter on Windows 2000-based, Windows XP-based, and Windows Server 2003-based computers, http://support. microsoft.com/?kbid=821893; 2006b (accessed April 2006).
6. Microsoft Corporation. Microsoft products do not reflect Australian daylight saving time changes for the year 2006, http://support.microsoft.com/kb/ 909915; 2006c (accessed April 2006).
7. Mills DL. Precision synchronization of computer network clocks. ACM Computer Communication Review 1994;24(2):28-43 (April 1994).
8. Mills DL. A brief history of NTP time: confessions of an Internet timekeeper. ACM Computer Communications Review 2003; 33(2):9-22 (April 2003).
9. Nolan R, O'Sullivan C, Branson J, Waits C. First responders guide to computer forensics. Pittsburgh, PA: Software Engineering Institute, Carnegie Mellon University; 2005.
10. Sandhill Consulting. How Microsoft Windows NT 4.0 handles time, http://folkworm.ceri.memphis.edu/ew-doc/PROGRAMMER/NTandTime.html; 1998 (accessed April 2006).
11. Stevens MW. Unification of relative time frames for digital forensics. Digital Investigation 2004;1:225-39.
12. Thomas LK. Reverse engineering index.dat, http://www.latenighthacking. com/projects/2003/reIndexDat/; 2003 (accessed April 2006).
13. Weil C. Dynamic time & date stamp analysis. International Journal of Digital Evidence 2002;1(2).