The Recording Of Time On Computer Systems

All means of recording time on computer systems have fundamental limitations imposed by the fact that the underlying data type is some form of number. The constraints take three forms:

• The number must start at some specified point in time (known as the 'epoch')
• The number must have a minimum and a maximum, after which point a 'wrapping' of the time occurs.
• The number is discrete. It can only record an instant in time with an accuracy dictated by the specification.

Further constraints are imposed when we consider the  accuracy of the internal clocks within computers; they are usually poor, usually relying on the fact that they may occasionally be updated from an NTP (or SNTP) server.

It is beyond the scope of this help file to examine more than a few means of recording time on computer systems. The main systems of interest to the forensic examiner are:

• Windows
• Unix/Linux

It should be noted that applications running on any of these operating systems or any non-standard file systems may record time in any way that suits the programmer(s) that built that system. In other words a programmer may choose to use a standard format but they don't have to.