DEV Community

yutianle
yutianle

Posted on

Clock synchronisation as a forensic prerequisite

#forensics #timesync #logging

Clock synchronisation as a forensic prerequisite

Why time is part of the evidence

An incident timeline built from logs with unsynchronised clocks is a timeline with error bars nobody measured. Comparing an authentication event on a domain controller with a firewall session on a perimeter device requires both systems to agree on what the current moment means to within the resolution of the comparison. When they do not, analysts spend the first day of an investigation reconciling timestamps instead of scope.

What a usable configuration contains

Three elements determine whether the timestamps survive scrutiny:

  • a defined source hierarchy, so every host derives time from a small number of internal servers that in turn derive it from external references
  • a monitored offset, so drift is detected before it becomes an argument about evidence
  • a record of the configuration itself, so the analyst knows which source was authoritative during the incident window RFC 5905 describes the protocol behaviour behind Network Time Protocol deployments. On Windows estates, the Windows Time service documentation covers the domain hierarchy, the tooling used to inspect configuration, and the polling and correction behaviour that follows from it.

Practical checks

  1. Confirm the domain controller holding the PDC emulator role points at a reliable external source, and that member servers follow the domain hierarchy rather than a public pool.
  2. Compare measured offset across the estate at the same moment. A single host that disagrees by minutes is either misconfigured or excluded from the hierarchy.
  3. Record times in UTC in centralised logging, and keep the conversion at the presentation layer. Configurations that log local time with a separate timezone field break correlation during daylight-saving transitions.
  4. Note virtualisation behaviour. Host clock settings propagate into guests, and a restored snapshot is a clock event.

What this buys

Synchronised time does not prove anything by itself. It removes a class of doubt that otherwise weakens every correlation in the report. For NIST SP 800-92 the practical expectation is the same: log records need a reliable timestamp and a documented handling process, because a record whose time is unknown cannot support a conclusion.

References

Top comments (0)