Re: Is there any method to detect change in system clock?
- From: Gary Smith <bitbucket@xxxxxxxxxxx>
- Date: Fri, 29 Jun 2007 17:22:59 -0700
I think it's safe to say that there is no way to prove that the described
actions took place -- or that they did not. Changing the system clock
leaves no persistent traces.
Mohit <Mohit@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote:
In this case, the legal Forensic lab would be checking about it. We are
giving pointers to the court/forensic lab that this can be done.
Hence, we can only rely on them that the machine is not tampered.
Thanks,
Mohit
"Gary Smith" wrote:
Mohit <Mohit@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote:
Is there any method by which one can detect a change in the system clock?
May be some place where such sort of log might be maintained and we can
check this log?
The clock was changed 2 months prior to the present date, and then again
restored back to the present date. This activity needs to be proved in the
court of law in a certain case.
Your help will be very helpful to get the innocents out of the case.
There may be some sort of event looging you can enable that would
constitute strong evidence, but working after the fact, I don't think
there is anything that can prove that these actions took place. Even if
you had such evidence, how would you prove that it had not been tampereed
with?
--
Gary L. Smith
Columbus, Ohio
--
Gary L. Smith
Columbus, Ohio
.
- References:
- Re: Is there any method to detect change in system clock?
- From: Gary Smith
- Re: Is there any method to detect change in system clock?
- Prev by Date: 0K files
- Previous by thread: Re: Is there any method to detect change in system clock?
- Next by thread: Windows 2000 / viewing thumbnails
- Index(es):
Relevant Pages
|
Loading
