Lesson 1.19: Time, time zones and timelines
An investigation is a story in time order, and logs from different systems rarely agree on how to write time. One writes local time with an offset, one is run by a provider in another country, one writes UTC. Sorting them as text produces a wrong story. In the lab you get a colleague's draft timeline of an intrusion that seems to start with an RDP logon, convert each source to UTC with date, rebuild the timeline, and discover the real order: web login first, then RDP. You also check that the servers' clocks were actually right.
16 min
You will learn to
- Explain UTC and UTC offsets
- Recognise time formats in different logs
- Convert timestamps to UTC with date
- Build a correct timeline
- Explain why clock synchronisation (NTP) matters
Key terms
- UTC
- Coordinated Universal Time: the global reference time with no time zone or daylight saving.
- UTC offset
- How far a local time is from UTC.
- ISO 8601
- The international standard date-time format: YYYY-MM-DDThh:mm:ss with an offset or Z.
- NTP
- Network Time Protocol: keeps computer clocks synchronised to reference servers.
- Timeline
- Events from all sources in one time-ordered list, the basis of an investigation.
← Requests, parameters, cookies and sessions · All lessons · Access keys and leaked secrets →