Computer time artifacts are undoubtedly one of the most important forms of digital evidence. They play a critical role when establishing a timeline for a body of evidence for any case where time is important. If the case involves an alibi, computer time artifacts can be used as part of a body of evidence to negate or validate the alibi claims. If the case involves data theft, computer time artifacts can be used to help determine when the alleged theft occurred. Furthermore, computer time artifacts are used extensively when attempting to prove or disprove user attribution. This form of evidence is arguably the most important when it comes to placing someone at a computer at a given time. While computer time artifacts are extremely valuable as evidence, they are also very complicated. There are numerous exceptions and variables when it comes to interpreting this type of evidence, and incorrect interpretations can lead to serious mistakes when coming to a conclusion based on computer time artifacts. These artifacts are most commonly called MAC times, which stands for Modified, Accessed, and Created. However, some file systems record four dates including the additional last written date. E-mail time stamps can also be confusing unless you are careful in the interpretation of the method of recording the time and the correct time zone of the time stamp record.

The purpose of this chapter is to familiarize you with the complexity of interpreting the date and time stamps recorded by computer operating systems and applications. To completely cover the subject of computer time stamps would require an entire technical book.

While you would think it would be a straightforward process to look at the dates and times recorded for a file and to know that those date and times accurately reflect when the file was created, modified, or accessed, that just simply is not the case. The reason for this dilemma is that different operating systems record these dates and times in different ways. For instance, older operating systems like Windows 98 and Windows XP record dates differently than Windows 7.

One of the easiest and most common mistakes that is made in the forensic analysis of computer-generated time stamps is either not checking to see if the computer clock that is creating the time stamps is accurate or not properly identifying the offset of the time local to the computer clock to the time zone format of the time stamp.

Depending on the device, be it a GPS unit, a computer, an e-mail server, a digital camera, or a web server at an Internet Service provider, the way that the date and time is recorded can be in different formats and different default time zones.

The most relied upon and most misunderstood part of many forensic examinations is the time stamps associated with the created, modified, and last accessed date recorded for files and folders on a computer hard drive. The following sections discuss these time stamps and how the interpretation of the time stamp is dependent on many factors. Simply pointing at a particular time stamp and making a claim about its connection to a timeline for a piece of evidence would be a mistake without properly interpreting how the time stamp was created.

Time stamps are not the end all of authority as to when something occurred. However, they can be critical if correctly interpreted by the examiner. In order to do so, the examiner must understand the different ways that time stamps are recorded by different computer operating systems, file systems, and various devices. The examiner must also understand what operation was being performed that may have changed the time stamp and in what way that operation would affect the recording of the time stamp. To simply say that the time stamp on a file or in a record is present is not sufficient; failing to analyze it completely can lead to incorrect analysis of the timeline in a case.

It is critically important that the examiner be well versed in how time stamps are modified and under what circumstances if the interpretation of the data is to be of any value. Also, the examiner must understand the nuances of the different operating systems and file systems and how each of them handles time stamps; otherwise, their interpretation could be completely wrong.

In this chapter we looked at the value of time stamps in the analysis of electronic evidence. We also looked at some of the many ways a time stamp can be affected by different operating systems, file systems, and devices. We learned that while time stamps are a critical part of the forensic analysis of electronic evidence, proper interpretation of time stamps is more complex than simply taking the time stamp at face value.