What does a timestamp in a log actually prove?¶

A timestamp in a log proves that a system recorded a time value against an event.

That may sound obvious, but it is the correct starting point.

Avoid this assumption: That the timestamp automatically proves the exact real-world moment when a person performed the recorded action. It does not.

The time may have been created by a device, server, cloud service, application, collector or monitoring platform. It may represent when activity began, when it ended, when the system wrote the record, when the record was received or when it was displayed.

A timestamp can be strong evidence when its source and meaning are known. It may help establish sequence, compare events across systems and test an account of what happened.

But its accuracy depends on the clock that created it. That clock may have been wrong, unsynchronised, set to another time zone or changed manually. The timestamp may also have limited precision, showing only whole seconds when several events occurred within the same second.

Investigators should identify the system and field that produced the time. Ask whether it is event time, completion time, ingestion time, processing time or display time. Record the time zone, format and precision.

Where timing is important, compare the timestamp with other records and with any known reliable reference. Preserve the original value rather than converting it without recording the method used.

Do not describe a timestamp as exact unless the evidence supports that level of certainty. It may establish an approximate or system-recorded time rather than an absolute real-world moment.

Operational takeaway¶

A timestamp proves that a system associated a time value with an event, but its evidential meaning depends on the clock, field definition, time zone, precision and processing stage.