Can File Timestamps Be Trusted

TIMESTAMPRELIABILITY · AGUIDEFORUKLAWYERS Can File Timestamps Be Trusted? What Each Timestamp Measures, When It Lies, and How to Tell COMPUTERFORENSICSLAB § ABOUTTHEAUTHOR PRE PA REDBYCOMPUTERFORENSICSLABE - DISCOVERYTEAM MANIPULATION DETECTION CPR PART 35 EXPERT REPORTS FULL CHAIN-OF-CUSTODY DOCUMENTATION § CONTENTS In this guide 01 Executive summary 02 The problem in plain English: a timestamp is a record, not a fact 03 The timestamp families: file system, document, platform and transmission 04 Innocent rewrites: copies, moves, migrations, sync and time zones 05 Clocks: drift, misconfiguration, time zones and calibration 06 Manipulation: how timestamps are changed, and the traces it leaves 07 Trustworthiness in practice: corroboration, grading and pleading dates 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist § 0 1 · ORIENTATION Executive summary THEHEADLINEPOINT : ATIMESTAMPISTRUSTWORTHYWHENYOUKNOWWHICH SYSTEMWROTEIT , WHATEVENTITRECORDS , THATTHECLOCKWASRIGHT , ANDTHAT INDEPENDENTRECORDSAGREE : ANDUNTRUSTWORTHY , ORATLEASTUNPROVEN , WHENEVERANYOFTHOSEISUNKNOWN § 0 2 · FIRSTPRINCIPLES The problem in plain English: a timestamp is a record, not a fact § 0 3 · THEFAMILIES The timestamp families: file system, document, platform and transmission § 0 4 · INNOCENTREWRITES Innocent rewrites: copies, moves, migrations, sync and time zones § 0 5 · CLOCKS Clocks: drift, misconfiguration, time zones and calibration § 0 6 · MANIPULATION Manipulation: how timestamps are changed, and the traces it leaves § 0 7 · TRUSTWORTHINESSINPRACTICE Trustworthiness in practice: corroboration, grading and pleading dates § 0 8 · THEWIDERMAP Source architecture: where else the evidence lives QUESTION SYSTEM INTERNAL COUNTERPART + CLOCK FILE- DOCUMENT- BACKUPS + SYSTEM STAMPS STAMPS COPIES LOGS PLATFORM TRANSMISSION RECORDS RECORDS § 0 9 · INTHEWILD Worked examples EXAMPLE1 · THECREATEDDATETHATWASACOPY EXAMPLE2 · THECLOCKTHATWASSETBACK , ANDTHELOGTHATNOTICED EXAMPLE3 · THETIMESTAMPSTHATDISAGREEDANDTHEONETHATWASRIGHT § 1 0 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations § 1 1 · INTERROGATORIES & DRAFTINGAIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your eDiscovery / forensic provider SUGGESTEDWORDING · INSTRUCTIONFORTIMES TA MPRELIABILITYEXAMIN AT ION § 1 2 · QUICKCONTROL Checklist and red flags · When to involve a digital forensic expert The timestamp checklist Red flags When to involve a digital forensic expert § 1 3 · COMMONQUESTIONS Frequently asked questions The file says it was created after it was last modified. Is that proof of tampering? Which timestamps are most reliable? Can timestamps really be faked? Our device's clock was wrong. Are its timestamps useless? The other side's chronology rests on file dates. How do we test it? Does opening a file change its timestamps? § 1 4 · REFERENCE Glossary Sources and authoritative references DISCLAIMER § HOWASPECIALISTLABORATORYCANASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY