Page 1

TIMESTAMPRELIABILITY · A GUIDE FOR UK LAWYERS Can File Timestamps Be Trusted? What Each Timestamp Measures, When It Lies, and How to Tell COMPUTER FORENSICS LAB

§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM MANIPULATION DETECTION CPR PART 35 EXPERT REPORT S FULL CHAIN-OF-CUSTODY DOCUMENTATION

§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: a timestamp is a record, not a fact 03 The timestamp families: file system, document, platform and transmission 04 Innocent rewrites: copies, moves, migrations, sync and time zones 05 Clocks: drift, misconfiguration, time zones and calibration 06 Manipulation: how timestamps are changed, and the traces it leaves 07 Trustworthiness in practice: corroboration, grading and pleading dates 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist

§ 01 · ORIENTATION Executive summary THE HEADLINE POINT: ATIMESTAMPISTRUSTWORTHYWHENYOUKNOWWHICH SYSTEMWROTEIT, WHATEVENTITRECORDS, THATTHECLOCKWASRIGHT, ANDTHAT INDEPENDENTRECORDSAGREE: ANDUNTRUSTWORTHY, ORATLEASTUNPROVEN, WHENEVERANYOFTHOSEISUNKNOWN

§ 02 · FIRST PRINCIPLES The problem in plain English: a timestamp is a record, not a fact

§ 03 · THEFAMILIES The timestamp families: file system, document, platform and transmission