Time, clocks, and the ordering of events in a distributed system
Communications of the ACM
Computer and Intrusion Forensics
Computer and Intrusion Forensics
Digital Evidence and Computer Crime
Digital Evidence and Computer Crime
Time and date issues in forensic computing-a case study
Digital Investigation: The International Journal of Digital Forensics & Incident Response
Event sequence mining to develop profiles for computer forensic investigation purposes
ACSW Frontiers '06 Proceedings of the 2006 Australasian workshops on Grid computing and e-research - Volume 54
Digital Investigation: The International Journal of Digital Forensics & Incident Response
A correlation method for establishing provenance of timestamps in digital evidence
Digital Investigation: The International Journal of Digital Forensics & Incident Response
| Hi-index | 0.00 |
As digital investigations begin to involve more independent sources of digital timing information, it is becoming increasingly difficult to compare and correlate time stamps that reference these different time sources. Unless the time sources are synchronised to a reliable time source, then at any one moment, each time source can give a different time reading due to a number of different factors. A clock model is presented that can account for these factors and can simulate the behaviour of each independent clock. The clock models can then be used to remove the predicted clock errors from the time stamps to get a more realistic indication of the actual time at which the events occurred. All the time stamps from different sources can then be unified onto a single time-line.