从一个时间标签被取证人员错误修改的案例出发,介绍计算机的日期和时间结构、MAC时间标签的含义,以及本地时间和UTC时间的转换问题,提出一些帮助涉及时间问题调查的规则和建议。
In this paper, a case study is outlined in which time stamps were contaminated by forensic investigator, which is followed by descriptions of date and time structure, meanings of MAC time stamps, issues of transformation between local time and UTC times. It is the purpose of this paper to focus on the methods of temporal analysis and to project intuitional rules on the behavioral characteristics of related digital files.