236 | Page
Ch a p t e r 2 0 – D a t e a n d T i m e
Copyright GetData Forensics Pty Ltd 2010 - 2015, All rights reserved.
DATE AND TIME IN COMPUTER FORENSICS
Timestamps are often important in a computer forensics examination. The investigator
should have a clear understanding of the subject before making critical conclusions.
When date and time is in issue, the following verified information should be at hand:
The time zone where the computer or device was operating when it was
The time of the computer BIOS clock compared with a verified time source
(e.g. a recorded time service) for that location.
It is the file system in use which determines whether Modified, Accessed and Created
(MAC) times are stored in local time or Coordinated Universal Time (UTC). Appendix 4
- Summary of Date and Time, is a summary table of file system date and time,
including the location of the source data interpreted by Forensic Explorer.
Date and time attributes of individual files can be examined using the Filesystem
Record view of the File System module (see 8.10 - Filesystem Record view, for more
FAT, HFS, CDFS FILE SYSTEM DATE AND TIME
FAT, HFS and CDFS store local date and time as per on the BIOS clock. There is no time
zone adjustment. For example:
A file stored at 11am is stored in the file system as 11am.
When Forensic Explorer opens this file, the default file time will display as 11am.
NTFS, HFS+ FILE SYSTEM DATE AND TIME
NTFS and HFS+ file systems store date and time in Coordinated Universal Time (UTC),
which in practical terms, when fractions of a second are not important, can be
considered equivalent to Greenwich Mean Time (GMT). In order to display date and
time information in a format relevant to the end users location, the UTC time is
translated into local time using the computers time zone setting.
DATE AND TIME INFORMATION IN THE WINDOWS REGISTRY
Windows time zone settings are held in the Windows registry. They are set during
install and can be modified at any time via the Time Zone Setting options of the
control panel (shown below):