TID - Timestamps in Digital Forensics

11-Jan-2005

Overview

Timestamps in Digital Forensics- TID is a research project seeking to improve the evidential quality of digital evidence by improving the understanding of timestamps in a forensic context. The project is run by Department of Telematics , Norwegian University of Science and Technology and funded under the Norwegian Research Council programme for information security research. (IKT-SoS) The project is supported by external partners Norwegian Police Computer Crime Unit , Ibas AS and FAST ASA .

Researchers

  • Professor Stig Frode Mjølsnes
  • PhD student Svein Yngvar Willassen

    Objectives and expected results

    Research problem:
    Technical and procedural methods for providing forensic ICT evidence, with focus on digital time-stamps where the main challenge is the questionability of time sources in an evidentiary context.

    Main goals:

  • Become a spearhead activity by performing the first information security research project in Norway with PhD students in methods and tools particularly aimed at the emerging scientific field of forensic ICT evidence.
  • Responding to needs articulated by national authorities on cyber-crime, by establishing and cooperate with a research partnership of Norwegian and international organisation on digital forensics and investigation practice.
  • In the problem setting of forensic ICT evidence, gain a deep understanding and develop methods for investigation and assessment of digital time-stamps used in electronic devices, digital media and network protocols.

    The time reference problem

    Forensic examiners who wish to use time-stamps as evidence are experiencing the following deficits:

  • There is little systematic documentation on time-stamp formats available.
  • There is a lack of documentation of the use of time-stamps and time-zones in systems.
  • Reference systems including different calendars, leap years and leap seconds vary.
  • It is unclear how time-stamps in file systems are handled at different operations on different operating systems.

    In addition the investigator will encounter more fundamental problems regarding the use of digital time-stamps as evidence. Computer programs can manipulate most time-stamps. Time-stamps are related to a time-source, often a clock or a network service. Clocks can be unreliable, not working, or not synchronized.

    These fundamental problems present great challenges to computer forensic investigators. The reason is the nature of investigations digital forensics is a part of. If the timeline cannot be established beyond reasonable doubt, the evidence is often worthless since it cannot be established who was using the computer at a particular time. In several recent court cases, it has been alleged that the timeline cannot be established beyond reasonable doubt, since the time-source may be manipulated or time-stamps may be manipulated by computer programs. Such allegations may create reasonable doubt on computer usage and may lead to incorrect acquittals or convictions.

    The time reference problem can be met by finding procedures for the identification of erroneous or manipulated time-stamps. That is a major technical goal of this project.

    • Publications:

  • Timestamps in Digital Forensics - full project description

    •