Builds on: Advanced Electronic Evidence (Part 1): Collection, Imaging and Recovery
Computers: Artefacts, Timestamps and Timelines
Readiness training. LEA.Training does not grant any official certificate, licence or authority.
A computer keeps a diary that its user never sees: which programs ran, which files were opened, which drives were plugged in, and when. The hard part is knowing what each entry really means.
Focus: what the traces show, what a time stamp does and does not prove, how to build a timeline, and how to test "it was not me". This unit is general knowledge. It is not legal advice.
Learning objectives
- Name the main kinds of trace a computer keeps about its use.
- Explain what a file's time stamps mean, and four ways they mislead.
- Build a simple timeline from several sources, in one time zone.
- Separate "this user account" from "this person".
- Test a claim that malware or a remote user was responsible.
This lesson opens when you enrol
₹999 · Devices and Forensic Practice, all 10 lessons · 365-day access · Price includes GST
Already bought it? Sign in to open it in your classroom.
Video coming soon. The lesson text covers everything you need.
Learning Check
A short, untimed check for this lesson. It is not graded and does not count toward the final assessment. The check runs on the server: questions are sent one attempt at a time and answers are never sent to your browser before you submit.
An offline PDF of this lesson will be available here for enrolled learners.