Hoffmann Investigations offers an advanced course on computer forensics. Recognized experts will teach from March 16 to 20 at Hoffmann's office in Almere, NL.
Continue reading Advanced Forensics Course.
October 2008 Archives
Didier Stevens complains about the feigned accuracy of timestamps in forensic reports and tool outputs. Timestamps are indicated up to the dot, though the accuracy of the data source is worse. Stevens cites the electronic purse as an example. Another example, that should be well-known among computer forensic practitioners, is the FAT file system that provides timestamps with a resolution of only 2 seconds. Therefore Stevens suggests to use the scientific error notation in reports, e.g. 11:37:30 ± 675s.
