<a id="ch-09"></a>

## Chapter 9 — Three clocks stay three clocks

<!-- open-cyber-academy:lesson-figures:start ch-09 -->
### Lesson map

Lesson 09. Map, example, EX055.

```mermaid
flowchart TD
  M["about 13:50, remembered"] --> N["The first note keeps it"]
  B["13:46, advert page"] --> A["A later line adds it"]
  F["13:48, file time"] --> A
  N --> Q{"Does the checked time erase the memory?"}
  Q -->|No| K["Notes add"]
```

Three times describe one afternoon. None of them replaces the others.

### Logical drawing

```text
memory
  about 13:50
browser history
  advert page 13:46
file time
  13:48
note rule
  add a line
  do not rewrite the earlier line
```
<!-- open-cyber-academy:lesson-figures:end ch-09 -->

### Learning outcomes

After this chapter, you should be able to:

1. Name the memory, the advert time, and the file time.
2. Say which line was written first.
3. Refuse a note that deletes "about 13:50".

### 9.1 The checked time is added. The remembered phrase stays.

Tomás remembered the download as about 13:50. That phrase is what the first note recorded, beside the 14:20 report. Later, browser history showed the advert page at 13:46, and the file time read 13:48. Priya adds those checked times. She does not go back and replace the remembered phrase with the neater one. A reader who sees only 13:48 has lost the fact that memory and the file disagreed by a small, stated amount.

The disagreement is useful. Memory was close, and it was not exact. The file time is the better clock for "when the download landed", because it is a property Priya read, not a reconstruction. The advert time is a different event: a page view, two minutes earlier. Carrier (2005) treats file times as metadata that still need a source. This course does not parse a raw file-system structure. It teaches the three clocks Priya actually wrote down.

Priya's later line cites the browser and the file and leaves the volunteer's phrase where it was written. A checker can still see all three clocks.

| Clock | Kind of trace |
|---|---|
| about 13:50 | Tomás's memory, kept in the first note |
| 13:46 | Advert page in browser history |
| 13:48 | File time Priya read |
| One merged clock | Not what the notes contain |

### 9.2 Worked example

| Offered note | What it does to the record | Decision |
|---|---|---|
| First line keeps about 13:50; a later line adds 13:48 and 13:46 | Addition | Keep |
| "Correct the first line to 13:48 and delete the memory." | Rewrites an old entry | Refuse |
| "The advert and the file are the same instant." | Two minutes apart | Refuse |
| All three remain visible | A checker can see the gap | Keep |

> **Synthetic case.** The clocks belong to FB-LAP-02's Tuesday.

### Errors and limits

Do not sand the remembered phrase down so the file looks perfectly consistent.

### Apply

- **EX055 — Three clocks.** Tomás said about 13:50. The advert page is 13:46 and the file time is 13:48. May a later note replace the remembered phrase with the file time? *Rubric:* 3 = no; notes add; about 13:50 stays; 13:46 and 13:48 are added as their own traces;; 2 = the memory stays and the checked times are added;; 1 = one clock;; 0 = none.

<!-- open-cyber-academy:chapter-navigation:start ch-09 -->
### Continue studying — lesson 09 (chapter 09 of 20)

[← Chapter 08](#ch-08) · [Course chapter index](../SUBJECTS.md) · [Chapter 10 →](#ch-10)

Continue to the next authored lesson.
<!-- open-cyber-academy:chapter-navigation:end -->

## Worked answers

<a id="answer-ex055"></a>
**EX055.** No. Notes add. About 13:50 stays in the first line. 13:46 and 13:48 are added as their own traces.
