Page 1
TIMESTAMPRELIABILITY · A GUIDE FOR UK LAWYERS Can File Timestamps Be Trusted? What Each Timestamp Measures, When It Lies, and How to Tell COMPUTER FORENSICS LAB
§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM MANIPULATION DETECTION CPR PART 35 EXPERT REPORT S FULL CHAIN-OF-CUSTODY DOCUMENTATION
§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: a timestamp is a record, not a fact 03 The timestamp families: file system, document, platform and transmission 04 Innocent rewrites: copies, moves, migrations, sync and time zones 05 Clocks: drift, misconfiguration, time zones and calibration 06 Manipulation: how timestamps are changed, and the traces it leaves 07 Trustworthiness in practice: corroboration, grading and pleading dates 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist
§ 01 · ORIENTATION Executive summary THE HEADLINE POINT: ATIMESTAMPISTRUSTWORTHYWHENYOUKNOWWHICH SYSTEMWROTEIT, WHATEVENTITRECORDS, THATTHECLOCKWASRIGHT, ANDTHAT INDEPENDENTRECORDSAGREE: ANDUNTRUSTWORTHY, ORATLEASTUNPROVEN, WHENEVERANYOFTHOSEISUNKNOWN
§ 02 · FIRST PRINCIPLES The problem in plain English: a timestamp is a record, not a fact
§ 03 · THEFAMILIES The timestamp families: file system, document, platform and transmission
Page 2
§ 04 · INNOCENTREWRITES Innocent rewrites: copies, moves, migrations, sync and time zones
§ 05 · CLOCKS Clocks: drift, misconfiguration, time zones and calibration
§ 06 · MANIPULATION Manipulation: how timestamps are changed, and the traces it leaves
§ 07 · TRUSTWORTHINESSINPRACTICE Trustworthiness in practice: corroboration, grading and pleading dates
§ 08 · THEWIDERMAP Source architecture: where else the evidence lives QUESTION SYSTEM INTERNAL COUNTERPART + CLOCK FILE- DOCUMENT- BACKUPS + SYSTEM STAMPS STAMPS COPIES LOGS PLATFORM TRANSMISSION RECORDS RECORDS
§ 09 · IN THE WILD Worked examples EXAMPLE1 · THE CREATED DATE THAT WAS A COPY EXAMPLE2 · THECLOCKTHATWASSETBACK, ANDTHELOGTHATNOTICED EXAMPLE3 · THETIMESTAMPSTHATDISAGREEDANDTHEONETHATWASRIGHT
Page 3
§ 10 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations
§ 11 · INTERROGATORIES & DRAFTING AIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your e Discovery / forensic provider SUGGESTED WORDING · INSTRUCTION FOR TIME S TA MPRELIABILITYEXAMIN AT ION
§ 12 · QUICK CONTROL Checklist and red flags · When to involve a digital forensic expert The timestamp checklist Red flags When to involve a digital forensic expert
§ 13 · COMMON QUESTIONS Frequently asked questions The file says it was created after it was last modified. Is that proof of tampering? Which timestamps are most reliable? Can timestamps really be faked? Our device's clock was wrong. Are its timestamps useless? The other side's chronology rests on file dates. How do we test it? Does opening a file change its timestamps?
§ 14 · REFERENCE Glossary Sources and authoritative references DISCLAIMER
§ HOW A SPECIALIST LABORATORY CAN ASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY
Cite as: Joseph Naghdi, Can File Timestamps Be Trusted, Computer Forensics Lab, https://e-discovery.uk/library/can-file-timestamps-be-trusted/pdf.