Three clocks stay three clocks | Rapid course Digital forensics and malware analysis

Lesson map

Lesson 09. Map, example, EX055.

flowchart TD
  M["about 13:50, remembered"] --> N["The first note keeps it"]
  B["13:46, advert page"] --> A["A later line adds it"]
  F["13:48, file time"] --> A
  N --> Q{"Does the checked time erase the memory?"}
  Q -->|No| K["Notes add"]

Three times describe one afternoon. None of them replaces the others.

Logical drawing

memory
  about 13:50
browser history
  advert page 13:46
file time
  13:48
note rule
  add a line
  do not rewrite the earlier line

Learning outcomes

After this chapter, you should be able to:

Name the memory, the advert time, and the file time.
Say which line was written first.
Refuse a note that deletes "about 13:50".

9.1 The checked time is added. The remembered phrase stays.

Tomás remembered the download as about 13:50. That phrase is what the first note recorded, beside the 14:20 report. Later, browser history showed the advert page at 13:46, and the file time read 13:48. Priya adds those checked times. She does not go back and replace the remembered phrase with the neater one. A reader who sees only 13:48 has lost the fact that memory and the file disagreed by a small, stated amount.

The disagreement is useful. Memory was close, and it was not exact. The file time is the better clock for "when the download landed", because it is a property Priya read, not a reconstruction. The advert time is a different event: a page view, two minutes earlier. Carrier (2005) treats file times as metadata that still need a source. This course does not parse a raw file-system structure. It teaches the three clocks Priya actually wrote down.

Priya's later line cites the browser and the file and leaves the volunteer's phrase where it was written. A checker can still see all three clocks.

Lesson table; scroll horizontally to read all columns →

Clock	Kind of trace
about 13:50	Tomás's memory, kept in the first note
13:46	Advert page in browser history
13:48	File time Priya read
One merged clock	Not what the notes contain

9.2 Worked example

Lesson table; scroll horizontally to read all columns →

Offered note	What it does to the record	Decision
First line keeps about 13:50; a later line adds 13:48 and 13:46	Addition	Keep
"Correct the first line to 13:48 and delete the memory."	Rewrites an old entry	Refuse
"The advert and the file are the same instant."	Two minutes apart	Refuse
All three remain visible	A checker can see the gap	Keep

Synthetic case. The clocks belong to FB-LAP-02's Tuesday.

Errors and limits

Do not sand the remembered phrase down so the file looks perfectly consistent.

Apply

EX055 — Three clocks. Tomás said about 13:50. The advert page is 13:46 and the file time is 13:48. May a later note replace the remembered phrase with the file time?
Show marking criteria
Rubric: 3 = no; notes add; about 13:50 stays; 13:46 and 13:48 are added as their own traces;; 2 = the memory stays and the checked times are added;; 1 = one clock;; 0 = none.