Wrinkle In Time


Published on

Published in: Technology, Education
  • Be the first to comment

  • Be the first to like this

No Downloads
Total views
On SlideShare
From Embeds
Number of Embeds
Embeds 0
No embeds

No notes for slide

Wrinkle In Time

  1. 1. Wrinkle in Time
  2. 2. Wrinkle in Time <ul><li>Why do we care about time? </li></ul>
  3. 3. Wrinkle in Time <ul><li>We use the Time/Date data to; </li></ul><ul><ul><li>Determine who used a computer. </li></ul></ul><ul><ul><li>Determine when a computer was used. </li></ul></ul><ul><ul><li>How long a computer was used. </li></ul></ul><ul><ul><li>Determine when an event occurred. </li></ul></ul><ul><ul><li>Determine a files’ use and/or source. </li></ul></ul>
  4. 4. Wrinkle in Time <ul><li>Today’s outline </li></ul><ul><ul><li>General information on time </li></ul></ul><ul><ul><li>The Types of time </li></ul></ul><ul><ul><li>The Time Zones </li></ul></ul><ul><ul><li>Day Light Saving Time </li></ul></ul><ul><ul><li>Sources of Time </li></ul></ul><ul><ul><li>Places we find Time and Dates on a PC </li></ul></ul>
  5. 5. General Stuff <ul><li>All dates and times on a computer are dependent on its’ clock being accurately set and running. This can apply to the suspects’ computer clock, the clock of a server or your own forensic machine. </li></ul><ul><li>A clock that is correctly set now may not have been correctly set in the past. </li></ul>
  6. 6. Types of Time <ul><li>There are many different types of time. </li></ul>
  7. 7. Base Time <ul><li>GMT - G reenwich M ean T ime </li></ul><ul><li>UT – U niversal T ime </li></ul><ul><li>UCT – C oordinated U niversal T ime </li></ul>
  8. 8. Greenwich Time <ul><li>GMT - G reenwich M ean T ime </li></ul><ul><li>Greenwich, England has been the home of Greenwich Mean Time (GMT) since 1884.  GMT is sometimes called Greenwich Meridian Time because it is measured from the Greenwich Meridian Line (longitude 0) at the Royal Observatory  in Greenwich, England. One property of GMT is that it remains the same all year around, Daylight Saving time does not affect it. It is the starting point of time (well, kinda the start). </li></ul><ul><li>Setting your time to “London” does not mean GMT, </li></ul><ul><li>Why? </li></ul>
  9. 9. Greenwich Time <ul><li>GMT - G reenwich M ean T ime </li></ul><ul><li>Greenwich, England has been the home of Greenwich Mean Time (GMT) since 1884.  GMT is sometimes called Greenwich Meridian Time because it is measured from the Greenwich Meridian Line (longitude 0) at the Royal Observatory  in Greenwich, England. One property of GMT is that it remains the same all year around, Daylight Saving time does not affect it. It is the starting point of time (well, kinda the start). </li></ul><ul><li>Setting your time to “London” does not mean GMT, </li></ul><ul><li>Why? London observes Daylight Saving Time. </li></ul>
  10. 10. Universal Time <ul><li>UT - U niversal T ime </li></ul><ul><li>Another name for GMT </li></ul><ul><li>Done by star observations, this is traditional time. </li></ul>
  11. 11. Coordinated Time <ul><li>UTC - C oordinated U niversal T ime (yes, I agree, blame the frogs) </li></ul><ul><li>Replaced Greenwich Mean Time (GMT) as the World standard for time in 1986. It is based on an atomic clock measurements rather than the earth's rotation. To align it with “traditional time” based on the earth rotation, the time is adjusted once a year. </li></ul>
  12. 12. AM - PM <ul><li>12:01( just past midnight ) is this AM or PM? </li></ul>
  13. 13. AM - PM <ul><li>12:01( just past midnight ) is this AM or PM? </li></ul><ul><li>AM </li></ul>
  14. 14. Time Format <ul><li>Time formats </li></ul><ul><ul><li>24 hour (military) </li></ul></ul><ul><ul><ul><li>Day starts at 00:00:00 </li></ul></ul></ul><ul><ul><ul><li>00:00, Midnight </li></ul></ul></ul><ul><ul><ul><li>12:00, Noon </li></ul></ul></ul><ul><ul><ul><li>Day ends at 23:59:59 </li></ul></ul></ul><ul><ul><li>12 hour (civil) </li></ul></ul><ul><ul><ul><li>Uses PM / AM </li></ul></ul></ul><ul><ul><ul><ul><li>AM : ante meridian, Starts at 12:00:01(past Midnight) </li></ul></ul></ul></ul><ul><ul><ul><ul><li>PM : post meridian Starts at 12:00:01(past Noon) </li></ul></ul></ul></ul>
  15. 15. Time Format <ul><li>24 hour format (Day starts at 0000) </li></ul><ul><li>0000 0300 0600 0900 1201 1500 1800 2100 2359 </li></ul><ul><li>12:00 3:00am 6:00am 9:00am 12:01pm 3:00pm 6:00pm 9:00pm 11:59pm </li></ul><ul><li>12 hour format </li></ul>
  16. 16. Time Format <ul><li>It’s 12:00 in the morning, is it AM or PM? </li></ul>
  17. 17. Time Format <ul><li>It’s 12:00 in the morning, is it AM or PM? </li></ul><ul><li>Neither </li></ul><ul><li>Midnight and Noon are not AM or PM </li></ul>
  18. 18. Time Zones <ul><li>Time Zones are geographically assigned. </li></ul><ul><li>Invented by Sir Sanford Fleming(1888) to help with train schedules. Prior to time zones every one kept their own time for an area, thousands of areas, thousands of different local time. </li></ul>
  19. 19. Time Zones <ul><li>There are 24 major time zones. </li></ul><ul><li>There are a few weird ones as well.( 1/2 hour zones ) </li></ul><ul><li>Here are some Abbreviations for times zones in the US. </li></ul><ul><ul><li>AST- Atlantic Standard Time </li></ul></ul><ul><ul><li>EST- Eastern Standard Time </li></ul></ul><ul><ul><li>CST- Central Standard Time </li></ul></ul><ul><ul><li>MST- Mountain Standard Time </li></ul></ul><ul><ul><li>PST- Pacific Standard Time </li></ul></ul><ul><ul><li>AKST- Alaskan Standard Time </li></ul></ul><ul><ul><li>HAST- Hawaii-Aleutian Standard Time </li></ul></ul>
  20. 20. US Time Zones <ul><li>The boundaries are fixed, give or take a little </li></ul><ul><li>Generally they change every 15 o </li></ul>Time Zones in the US
  21. 21. US Time Zones <ul><li>The Continental US has four Standard Time zones </li></ul><ul><ul><li>Eastern, -5 hours from GMT 7pm </li></ul></ul><ul><ul><li>Central, -6 hours from GMT 6pm </li></ul></ul><ul><ul><li>Mountain, -7 hours from GMT 5pm </li></ul></ul><ul><ul><li>Pacific, -8 hours from GMT 4pm </li></ul></ul><ul><li>There are also additional time zones for Alaska, Hawaii, the Virgin Islands and Samoa. </li></ul><ul><ul><li>Atlantic, -3 hours from GMT 9pm </li></ul></ul><ul><ul><li>Alaska, -9 hours from GMT 3pm </li></ul></ul><ul><ul><li>Hawaii/Aleutian -10 hours from GMT 2pm </li></ul></ul><ul><ul><li>Samoa -11 hours from GMT 1pm </li></ul></ul>
  22. 22. Places with “special” Time Zones <ul><li>The following states have two time zones within them, usually split by county. </li></ul><ul><ul><li>Kansas, Alaska, Florida, Idaho, Indiana, Kentucky, Michigan, Nebraska, North Dakota, Oregon, South Dakota, Tennessee, Texas </li></ul></ul><ul><li>Cross a street, you are in a new time zone. </li></ul><ul><ul><li>Beacon Hill and Mexico Beach, Florida. Cross the street (18’ of asphalt) and you are in a different city and time zone. One is eastern and the other central. </li></ul></ul>
  23. 23. International Time Zones <ul><li>International times zones can be even more complicated. </li></ul>
  24. 24. International Time Zones <ul><li>The preceding maps show the general boundaries. The actual boundaries can be quite different. For example, Australia has some very different time zone boundaries. In fact they have zones that are only ½ hour different. So does Canada. </li></ul>11:03 08:03 10:03 09:33 10:33
  25. 25. International Time Zones <ul><li>Lets skip the rest of the world for now. </li></ul>
  26. 26. Daylight Saving <ul><li>Daylight Saving Time begins in the United States at 2 a.m. on the first Sunday of April. Time reverts to standard time at 2 a.m. on the last Sunday of October. Time changes at 2 a.m. local time. </li></ul><ul><li>In the European Union , Daylight Saving Time begins and ends at 1 am Universal Time (Greenwich Mean Time). It starts the last Sunday in March, and ends the last Sunday in October. In the EU, all time zones change at the same moment. </li></ul><ul><li>HOWEVER, Congress changed our dates……. </li></ul>
  27. 27. Daylight Saving <ul><li>On August 8, 2005, President George W. Bush signed the Energy Policy Act of 2005 . This Act changed the time change dates for Daylight Saving Time in the U.S. Beginning in 2007, DST will begin on the second Sunday of March and end the first Sunday of November . The Secretary of Energy will report the impact of this change to Congress. Congress retains the right to revert the Daylight Saving Time back to the 2005 time schedule once the Department of Energy study is complete. So 2008 is up for grabs. </li></ul>
  28. 28. Daylight Saving Time <ul><li>Daylight Saving Time is NOT observed in; </li></ul><ul><li>All of Hawaii </li></ul><ul><li>All of American Samoa </li></ul><ul><li>All of Guam </li></ul><ul><li>All of Puerto Rico </li></ul><ul><li>All of The Virgin Islands </li></ul>
  29. 29. Daylight Saving Time in AZ <ul><li>Daylight Saving Time IS observed in the </li></ul><ul><li>Navajo Indian Reservation in Arizona, New Mexico and Utah. </li></ul><ul><li>Daylight Saving Time is NOT observed </li></ul><ul><li> anywhere else in the State of Arizona </li></ul><ul><li>The Hopi Partitioned Land in the </li></ul><ul><li>middle of the Navajo Reservation </li></ul><ul><li>does NOT observe Daylight Saving Time. </li></ul><ul><li>So AZ does not, Navajo does, Hopi does not </li></ul><ul><li>Got that ? </li></ul>
  30. 30. Daylight Saving Time in Indiana <ul><li>Daylight Saving Time in Indiana, well…. </li></ul><ul><li>77 of 92 counties do NOT change (white) </li></ul><ul><li>15 counties do change </li></ul><ul><ul><li>Yellow </li></ul></ul><ul><ul><ul><li>Gibson, Jasper, Lake, LaPorte, Newton, Porter, Posey, Spencer, Vanderburgh and Warrick county </li></ul></ul></ul><ul><ul><li>Blue </li></ul></ul><ul><ul><ul><li>Clark, Dearborn, Floyd, Harrison and Ohio county. </li></ul></ul></ul>
  31. 31. Time Problems <ul><li>Add time zones, daylight saving and date/time format all together and you have some complicated points to navigate when analyzing time and dates in digital evidence. </li></ul><ul><li>You’ll need to know how your software is affected and where was the computer used, what location and when. </li></ul><ul><li>To help, use this web site </li></ul><ul><li>http://www.timeanddate.com/time/dst2006a.html </li></ul>
  32. 32. Time Problems <ul><li>So what can happen if we get it wrong….. </li></ul>
  33. 33. Time Problems <ul><li>So what can happen if we get it wrong….. </li></ul><ul><li>Palestinian Terrorists </li></ul><ul><li>In September 1999, the Palestinian West Bank was on daylight saving time while Israel had just switched back to standard time. West Bank Palestinians prepared time bombs and smuggled them to Arab Israelis, who misunderstood the time on the bombs. As the bombs were being planted, they exploded—one hour too early—killing three terrorists instead of the intended victims—two busloads of people. </li></ul>
  34. 34. Time Problems <ul><li>Time Change Riots </li></ul><ul><li>Patrons of bars that stay open past 2:00 a.m. lose one hour of drinking time on the day when Daylight Saving Time springs forward one hour. This has led to annual problems in numerous locations, and sometimes even to riots. For example, at a &quot;time disturbance&quot; in Athens, Ohio, site of Ohio University, over 1,000 students and other late night partiers chanted &quot;Freedom,&quot; as they threw liquor bottles at the police attempting to control the riot. </li></ul>
  35. 35. Time Problems <ul><li>Manslaughter </li></ul><ul><li>In California, a Chevrolet Blazer packed with teenagers struck the median of a street and flipped over, tragically killing one teen and injuring several others. The teen driver, fighting charges of felony vehicular manslaughter, claimed that the street was dangerously wet and unsafe due a lawn sprinkler system. The landscaper responsible for the computerized sprinklers testified that the sprinklers were set to come on more than fifteen minutes after the fatal accident. The outcome hinged on whether the sprinklers' timer had been adjusted for a recent Daylight Saving Time change, for without the DST adjustment, the sprinklers had close to 45 minutes to make the road slick. </li></ul>
  36. 36. BREAK <ul><li>Why did I take this class……… </li></ul>
  37. 37. Sources of Time
  38. 38. Sources of Time <ul><li>Best source is atomic based time </li></ul><ul><ul><li>Internet time server </li></ul></ul><ul><ul><li>WWV & WWVB (radio time) </li></ul></ul><ul><ul><ul><li>WWV on 5, 10, 15 and 20 MHz </li></ul></ul></ul><ul><ul><ul><li>WWVB on 60 MHz </li></ul></ul></ul><ul><ul><li>Official US time from the web </li></ul></ul><ul><ul><ul><li>http://nist.time.gov </li></ul></ul></ul>
  39. 39. Sources of Time <ul><li>Other sources of time </li></ul><ul><ul><li>Phone time (767-1212)? Not accurate </li></ul></ul><ul><ul><li>Cell phone? Not accurate </li></ul></ul><ul><ul><li>Radio News (start of every hour)? No </li></ul></ul><ul><ul><li>Observe Sunrise, Noon, Sunset? No….. </li></ul></ul>
  40. 40. Sources of Time <ul><li>Buy a automatic clock and check it against the “nist.time.gov” web site prior to going out. </li></ul>
  41. 41. Wrinkle in Time <ul><li>File System Times and Dates </li></ul>
  42. 42. File System Times and Dates <ul><li>In this class we are discussing the Microsoft family of operating systems(OS). Other OS’s will be similar but not identical. </li></ul><ul><li>The following applies when applications and system programs operate using the file systems standard calls. No funny business. </li></ul><ul><li>You can access files directly without changing any dates and times with custom written programs. </li></ul><ul><li>All of this relies on the system clock accuracy. </li></ul>
  43. 43. File System Times and Dates <ul><li>The system clock does lose or gain time over time…… errr </li></ul><ul><li>The system clock can gain or lose time. </li></ul><ul><li>File time and dates rely on the system clock. </li></ul><ul><li>Some time and dates inside files are independent of the systems clock. More on that later…. </li></ul><ul><li>The following may not always apply, your mileage may vary. </li></ul>
  44. 44. Not Again….
  45. 45. Where do we find Times and Dates <ul><li>Directories and Folders </li></ul><ul><li>Within logs files (there are a lot) </li></ul><ul><li>Within Document files </li></ul><ul><li>In memory swap files </li></ul><ul><li>In Data Bases </li></ul><ul><li>In Emails </li></ul><ul><li>In Firmware </li></ul><ul><li>In the MFT$ </li></ul>
  46. 46. Times and Dates in Directories (FAT) <ul><li>Directories and Folders are two terms for the same thing. Directory is the term used in DOS and Folders is used for Windows GUI*. </li></ul><ul><li>In FAT file systems you will find MAC dates and times kept in the directory. </li></ul><ul><li>In NTFS file systems you will find MACE dates and times kept in the Master File Table. </li></ul><ul><li>MAC(E) </li></ul><ul><ul><li>M odified </li></ul></ul><ul><ul><li>A ccess </li></ul></ul><ul><ul><li>C reation </li></ul></ul><ul><ul><li>E ntry modified </li></ul></ul>* Graphical User Interface
  47. 47. Times and Dates in Directories (FAT) <ul><li>M odified </li></ul><ul><li>Modified, the last time the file was opened to be written to. </li></ul><ul><li>A file can be open to be “Modified” but not modified by an application. </li></ul>
  48. 48. Times and Dates in Directories (FAT) <ul><li>A ccess </li></ul><ul><li>Access, the last time the file was opened. It does not matter whether it was for reading and/or modifying. Even viewing a files properties will change the last access date. </li></ul>
  49. 49. Times and Dates in Directories (FAT) <ul><li>C reation </li></ul><ul><li>Creation, the recorded date and time that the file was created on this media and/or in a specific partition or directory. </li></ul>
  50. 50. Times and Dates in Directories (NTFS) <ul><li>In addition to the MAC times and dates you will find a Entry Modified time and date. </li></ul><ul><li>This is occurs when a change is made to the Master File Table(MFT). </li></ul><ul><li>There is also a “ Filename ” date and time in the MFT. This is written at the time the filename was created and not touched again in the MFT. </li></ul><ul><li>This is normally not seen but is there… Uhmmmm </li></ul><ul><li>ProDiscover is the only forensic tool I know of that presents it to you. There is also a Encase script available somewhere… At least that is </li></ul><ul><li>what I was told. </li></ul>
  51. 51. Log Files <ul><li>The OS keeps a number of log files with times and dates, here are a few; </li></ul><ul><li>Info2.dat (Recycle Bin) </li></ul><ul><li>Event Logs files </li></ul><ul><ul><li>system.evt, application.evt and security.evt </li></ul></ul><ul><li>Applog files </li></ul><ul><li>Index.dat </li></ul><ul><li>Offitems.log </li></ul><ul><li>The Registry entries can contain a last modified date. </li></ul><ul><li>Link files (.lnk) or commonly called “shortcuts”. </li></ul>
  52. 52. Document Files <ul><li>Office document files can contain MAC times and dates as well as last printed times and dates. Some files containing times and dates; </li></ul><ul><ul><li>Word, Excel, PowerPoint, Word Perfect, HTML documents, Visio diagrams, MS Publisher files, Open Office documents. </li></ul></ul>
  53. 53. Data Bases Files <ul><li>Various data bases can contain times and dates within the data base files. </li></ul><ul><ul><li>Access, SQL and Oracle </li></ul></ul><ul><ul><li>PST, NSF, DBX, MBX </li></ul></ul><ul><ul><li>Quicken, Versa Check </li></ul></ul>
  54. 54. Memory Swap Files <ul><li>System Swap file can contain dates and times from files held in memory. Index.dat files are a good example of this. </li></ul><ul><li>Look in the </li></ul><ul><ul><li>Win 2k, XP – Pagefile.sys </li></ul></ul><ul><ul><ul><li>temppf.sys if they moved the location of Pagefile.sys </li></ul></ul></ul><ul><ul><li>Win 98, 95 – Win386.swp </li></ul></ul><ul><ul><li>Win 3.1 – 386spart.par & Win386.swp </li></ul></ul>
  55. 55. Email Files <ul><li>Email files contain dates and times. They will be on the received lines and can also be in the body of the email. </li></ul><ul><li>The dates and times in an email can also be independent of the host computers clock. These would come from mail servers the email was processed by. </li></ul>
  56. 56. Hard Drives <ul><li>SMART data on hard drives keep track of running time. Modern drives keep track of how long they have been operating. </li></ul><ul><li>The MyKey Technology NoWrite tm write blocks allow you to get this data. </li></ul>
  57. 57. Wrinkle in Time <ul><li>Calculating the Time and Date from encoded values. </li></ul><ul><li>Time and Dates are usually encoded but there are a number of different ways it is done. </li></ul><ul><li>It’s all comes down to doing a little math. </li></ul>
  58. 58. Wrinkle in Time <ul><li>How many different types of encoded dates and times are there?. </li></ul>
  59. 59. How Many would you like?
  60. 60. Date & Time Formats <ul><li>Windows 64bit (Little Endian) </li></ul><ul><li>Windows 64bit (Big Endian) </li></ul><ul><li>Windows Cookie (LoValue, HiValue) </li></ul><ul><li>Windows File time </li></ul><ul><li>Unix Numeric </li></ul><ul><li>Unix 32bit (Little Endian) </li></ul><ul><li>MAC Absolute </li></ul><ul><li>MS-DOS 32bit </li></ul><ul><li>HFS 32bit (Little Endian) </li></ul><ul><li>HFS 32bit (Big Endian) </li></ul><ul><li>HFS+ 32bit (Little Endian) </li></ul><ul><li>HFS+ 32bit (Big Endian) </li></ul>
  61. 61. Windows Time and Date formats <ul><li>This is why programs like Encase, FTK and ProDiscover are nice, they do the hard work for us. </li></ul>
  62. 62. Windows Time and Date formats <ul><li>Craig Wilson also provides a FREE tool for this; </li></ul><ul><li>http://www.digital-detective.co.uk/freetools/decode.asp </li></ul><ul><li>Thank you Craig. </li></ul>
  63. 63. Misc. Time and Date Issues <ul><li>Each application or operation will affect the time and date differently. </li></ul><ul><li>Setting your time to London does not mean GMT(or UTC), London observes Daylight Saving Time. Set it to Casablanca which does not. </li></ul>
  64. 64. Misc. Time and Date Issues <ul><li>In a future presentation I plan to cover specific details on the files containing dates and times. This will include a list of the files, where they usually reside and how to extract the dates and times. </li></ul><ul><li>We will also look at the programs that can change the Time and Dates stamps and how to tell if one has been used. </li></ul>
  65. 65. Misc. Time and Date Issues <ul><li>Thank you for your attention. </li></ul><ul><li>Mark Menz </li></ul><ul><li>916-983-0348 </li></ul><ul><li>[email_address] </li></ul><ul><li>Go check out - http://www.nowrite.com </li></ul><ul><li>………. And remember…………=  </li></ul>
  66. 66. NoWrite FPU <ul><li>Hard drive write blocker </li></ul><ul><li>FireWire to both PATA and SATA drives </li></ul><ul><li>Meets NIST standards for hardware write blocking </li></ul><ul><li>Provides DriveID and Smart data </li></ul><ul><li>Fast, reliable </li></ul><ul><li>From the inventors of hard drive </li></ul><ul><li>write blocking. </li></ul><ul><li>$249.95 </li></ul>
  67. 67. <ul><li>Yea, it’s a shameless plug…… </li></ul><ul><li>Next month . . . . . . Two power points. </li></ul><ul><li>Investigative: Web bugs, Server hiding. </li></ul><ul><li>Forensic: Link files are your friends </li></ul>