Digital Forensics and Incident Response - Second Edition

Timeline analysis

When investigating an incident, it is critical to have an idea of when applications or files were executed. Timestamps can sometimes be found in other aspects of the investigation, such as when examining memory images. Also, identifying specific DLL files or executable files in the memory image can be compared to the date and time they were accessed in order to correlate other activity that's been observed on the system.

One aspect of digital forensics that bears repeating is to ensure that all the systems are using the same time zone. With network systems, this is usually accomplished with the Network Time Protocol (NTP). There are times where systems do not have normalized time through NTP. Responders should take great ...