Builds on: Advanced Electronic Evidence (Part 1): Collection, Imaging and Recovery
Computers: Artefacts, Timestamps and Timelines
Readiness training. LEA.Training does not grant any official certificate, licence or authority.
A computer keeps a diary that its user never sees: which programs ran, which files were opened, which drives were plugged in, and when. The hard part is knowing what each entry really means.
Focus: what the traces show, what a time stamp does and does not prove, how to build a timeline, and how to test "it was not me". This unit is general knowledge. It is not legal advice.
Learning objectives
- Name the main kinds of trace a computer keeps about its use.
- Explain what a file's time stamps mean, and four ways they mislead.
- Build a simple timeline from several sources, in one time zone.
- Separate "this user account" from "this person".
- Test a claim that malware or a remote user was responsible.
This lesson opens when you enrol
A$— · price for the Australia edition is not set yet
Already bought it? Sign in to open it in your classroom.
Video coming soon. The lesson text covers everything you need.
Learning Check
A short, untimed check for this lesson. It is not graded and does not count toward the final assessment. The check runs on the server: questions are sent one attempt at a time and answers are never sent to your browser before you submit.
An offline PDF of this lesson will be available here for enrolled learners.