Difference between pages "User talk:Anarchivist" and "System Time"
From Forensics Wiki
(Difference between pages)
m (Welcome!) |
m (Created page with 'The ''system time'' of a computer is typically the time and date of the computer's real time clock. Typically this information is not stored in a disk image but must be recovered…') |
||
| Line 1: | Line 1: | ||
| − | '' | + | The ''system time'' of a computer is typically the time and date of the computer's real time clock. Typically this information is not stored in a disk image but must be recovered separately when a computer is acquired. |
| − | + | ||
| − | + | It is a good idea to determine the system time so that you can state that the times in the file system are aligned with the times of a correct wall clock. | |
| − | + | ==Determine the System Time== | |
| + | ===PC=== | ||
| + | The system time of most PCs can be determined by booting into the BIOS and reading the system clock. | ||
| + | ===Macintosh=== | ||
| + | The system time of most Intel-based Macintoshes can be determined by booting a USB device equipped with [[rEFIt]]. This gives access to an EFI shell. You can now issue the '''date''' and '''time''' commands. Note that the time will be in GMT and the date will be in '''mm/dd/yy''' format. | ||
Latest revision as of 09:27, 27 May 2010
The system time of a computer is typically the time and date of the computer's real time clock. Typically this information is not stored in a disk image but must be recovered separately when a computer is acquired.
It is a good idea to determine the system time so that you can state that the times in the file system are aligned with the times of a correct wall clock.
[edit] Determine the System Time
[edit] PC
The system time of most PCs can be determined by booting into the BIOS and reading the system clock.
[edit] Macintosh
The system time of most Intel-based Macintoshes can be determined by booting a USB device equipped with rEFIt. This gives access to an EFI shell. You can now issue the date and time commands. Note that the time will be in GMT and the date will be in mm/dd/yy format.
