« September 2008 | Main | November 2008 »

Side notes

Advanced Forensics Course

Hoffmann Investigations offers an advanced course on computer forensics. Recognized experts will teach from March 16 to 20 at Hoffmann's office in Almere, NL.

(more...)

By Andreas Schuster at 10/08/2008, 04:00 PM |

Lab

Accuracy of Timestamps

Didier Stevens complains about the feigned accuracy of timestamps in forensic reports and tool outputs. Timestamps are indicated up to the dot, though the accuracy of the data source is worse. Stevens cites the electronic purse as an example. Another example, that should be well-known among computer forensic practitioners, is the FAT file system that provides timestamps with a resolution of only 2 seconds. Therefore Stevens suggests to use the scientific error notation in reports, e.g. 11:37:30 ± 675s.

By Andreas Schuster at 10/07/2008, 04:00 PM |