BIOS Time Calculator Tab

The components on this page conform to the following rules:

• Those labels in orange represent details in current LOCAL time
• Those labels in blue represent details in current UTC
• Those labels with a white or grey background are details about a time or time zone other than the current one on this machine
• Those controls with a white background indicate that the values can be changed whilst grey ones are just informational.
• The control with the green background is where the result appears.
• Warnings (when appropriate) appear in controls with red text and background.

What This Tab Does:

Taking the time from a computer BIOS and comparing it with the actual time would seem to be a straight forward operation but a number of factors may affect the calculation such as:

• What time is the BIOS clock set to, UTC or local?
• What time are you recording as the actual time, UTC or local?
• Is daylight savings time currently in effect?
• Was daylight savings time in effect when the computer was last used?
• Is the time zone on the machine the same as the time zone where you are conducting the examination?
• Is the local time an ambiguous time?

Putting some or all of these variables into the calculation can cause it to become horribly complex. The BIOS calculator removes this headache by just requiring you to fill in the data you know and hitting the 'Calculate' button.

Using The BIOS Calculator:

The tab is one of the most complex in the TimeLord application. However the basic premise is fairly simple:

• Record the time displayed by the BIOS clock on the examined machine and record the actual time that this was done
• Decide what method of accuracy you want to establish the time zone and time the machine was set to when it was last used. In decreasing order of accuracy these are:
  • From forensic analysis of the operating system. (best)
  • From some other evidence (such as the user telling you) when it was last used.
  • From the record of seizure and assuming local time and local time zone. (worst)
• Enter the data into the BIOS Calculator
• Press 'Calculate'

Examined Machine Time panel:

The components of this panel are;

The exhibit number/name box does not affect the calculation but the text you type here will appear on the report for reference.

Here you can enter the details of the time you recorded from the BIOS clock on the examined machine.

• The BIOS time component is a simple date/time component, the drop-down arrow will open up a calendar (unfortunately you will still have to type the time)
• The radio buttons (UTC or Local) are to pick whether the BIOS clock is set to local time or UTC. Both Windows and Linux systems have the capability to set the hardware (or BIOS) clock to use either. Windows usually uses local time but with Linux it depends on the distribution (Ubuntu defaults to local time but this is not a given).
• The 'Make Now' button sets the time in the BIOS Time control to the moment you click the button.
• The TimeZone control is only applicable if the examined machine is set to local time. Pick the time zone the machine is set to (i.e. the time zone that the BIOS clock is recording)

A CAUTIONARY NOTE:

The time zones used here emanate from the Windows registry on your own machine - they may not match with the registry settings on the examined machine (and may well be different if using Linux time zones). To avoid any errors, create a time zone on your own machine that matches the time zone on the examined machine (The associated Microsoft how-to page is here).

These boxes are for information relating to the time and time zone you set. For further information read:

• UTC
• Daylight Savings Time
• Ambiguous times

If the time for this time zone is ambiguous then the following warning will appear in the results box:

This control is the most accurate setting when applying a calculation and you should endeavour to complete this wherever possible. Important Note: This setting is the Bias TO UTC, not FROM UTC. TimeLord usually reports the offset from UTC but this control is easier to use when just applying the setting found in SYSTEM\ControlSet[n]\Control\TimeZoneInformation\ActiveBias on a WindowsXP system. For other operating systems you will have to research and find the correct setting yourself. You are looking for the last applied offset to UTC when the machine was last working.

If you are unable to find this setting then you can apply one of two alternative approximations by unticking the 'Use Time Bias' check box and the following controls will be enabled.

Here you can enter the time the time the machine was either last used or seized depending on the best available information. If you set the time as UTC then no adjustment will be made. If you set local time then the time will be adjusted in accordance with the time zone settings for the examined machine. The information boxes are the same as for the previous panel but are only active if Local is set.

• UTC
• Daylight Savings Time
• Ambiguous times

If the time for this time zone is ambiguous then the following warning will appear in the results box:

Actual Time panel:

This panel is where you set the actual (real) time that you recorded the BIOS time.

The controls are the same as for the Examined Machine Time panel and need no further explanation.

An example:

Lets take an example of the BIOS calculator in action.

A Windows XP computer has been seized in the UK in late July 2008. Analysis shows that the machine was last used at 10:23:02 on 1st March 2008. The computer was set to Pacific Standard Time (usually occurring if the user accepts all the defaults when installing). The BIOS time is recorded at 11:48:02 on 2nd August 2008 (local UK time) and the reading from the BIOS was 18:48:24 2nd August 2008. Analysis of the SOFTWARE registry hive shows the active time bias to have been -480 minutes; this is consistent with the offset that should apply on the date the machine was last used. The BIOS calculator will look like this:

Before capturing this image I unticked the 'Use Time Bias' checkbox and set the 'Last used' time before re-activating the 'Use Time Bias' control. The result is the same whichever method you use - try it yourself and see. This shows that the 'Last Recorded Time Bias' is the opposite value of the 'Offset From UTC' (with respect to 0 mins).