Which is a standard procedure to perform during all computer forensics investigations?

Which is a standard procedure to perform during all computer forensics investigations?

• A. With the hard drive in the suspect PC, check the date and time in the File Allocation Table
• B. With the hard drive removed from the suspect PC, check the date and time in RAM
• C. With the hard drive in the suspect PC, check the date and time in the system CMOS
• D. With the hard drive removed from the suspect PC, check the date and time in the CMOS

Answer: (D)

In computer forensics, having an independent, trustworthy time reference is essential for establishing the sequence of events. The CMOS clock on the motherboard is powered by its own battery and keeps time even when the system is off, making it a reliable baseline. Reading the date and time from the CMOS with the hard drive removed provides a time reference that is not influenced by the suspect’s disk contents, OS, or user activities. This helps preserve the integrity of the timeline because disk-based timestamps can be altered, manipulated, or misinterpreted, and RAM data is volatile and disappears when the machine is powered down. If the drive is left in or you rely on disk-based timestamps, you risk basing conclusions on data that might have been tampered with or are not stable indicators of actual time. Reading CMOS with the drive removed therefore offers the cleanest, most defensible time stamp for chronology.

In computer forensics, having an independent, trustworthy time reference is essential for establishing the sequence of events. The CMOS clock on the motherboard is powered by its own battery and keeps time even when the system is off, making it a reliable baseline.

Reading the date and time from the CMOS with the hard drive removed provides a time reference that is not influenced by the suspect’s disk contents, OS, or user activities. This helps preserve the integrity of the timeline because disk-based timestamps can be altered, manipulated, or misinterpreted, and RAM data is volatile and disappears when the machine is powered down.

If the drive is left in or you rely on disk-based timestamps, you risk basing conclusions on data that might have been tampered with or are not stable indicators of actual time. Reading CMOS with the drive removed therefore offers the cleanest, most defensible time stamp for chronology.