Timestamps need interpretation
A timestamp is a claim made by a particular system about a particular event, in whatever time zone it was configured with.
Different systems record different things under similar names: created, modified, accessed, and the meanings vary by platform. Clocks drift, time zones differ and attackers sometimes alter them deliberately. A timeline built from timestamps without establishing what each one actually means produces a confident and wrong story.
More on Digital forensics
- Forensic copies protect original evidenceMark the copy, never the original
- Hashes can show evidence stayed unchangedThe same short string, twice
- Memory can reveal what disk cannotIt has to unwrap itself to run
- Forensic tooling can change the thing examinedYou leave prints of your own
- Deleted does not always mean goneThe card, not the book
- Cloud forensics depends on provider evidenceYou get what comes through the hatch