CHAPTER ELEVEN

Time and Forensics

The only reason for time is so that everything doesn’t happen at once.

—Albert Einstein

WHAT IS TIME?

Depends on where you look for the answer:

Astronomy: A dimension distinguishing past, present, and future. In relativity, time is portrayed as a geometrical dimension, analogous to the dimensions of space.1

Physics: A quantity measuring duration, usually with reference to a periodic process such as the rotation of the Earth or the vibration of electromagnetic radiation emitted from certain atoms.

Classical mechanics: Time is absolute in the sense that the time of an event is independent of the observer.

Philosophy: Time is what clocks measure. We use time to place events in sequence one after the other, and we use time to compare how long events last.2

Information technology: A timestamp is a sequence of characters, denoting the date and/or time at which a certain event occurred. A timestamp is the time at which an event is recorded by a computer, not the time of the event itself.

Computer science: Unix time, which describes points in time, is defined as the number of seconds elapsed since midnight proleptic Coordinated Universal Time (UTC) of January 1, 1970, not counting leap seconds.

According to the theory of relativity, it depends on the observer’s frame of reference. Time is considered as a fourth coordinate required, along with three spatial coordinates, to specify an event.3

Time is a one-dimensional quantity used to sequence events, ...

Get Cyber Forensics: From Data to Digital Evidence now with the O’Reilly learning platform.

O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.