What is clock drift?¶

Clock drift is the gradual difference that develops between a device’s clock and the correct reference time.

A device may gain or lose seconds, minutes or more if it is not regularly synchronised.

Avoid this assumption: That because a clock was accurate when checked later, it must have been accurate throughout the period under investigation. That does not necessarily follow.

Computer clocks rely on hardware and software that are not perfectly precise. Temperature, power loss, hardware quality, virtualisation and system faults can all affect timekeeping.

Many managed systems use network time synchronisation to correct drift. But synchronisation can fail, be blocked or occur only periodically. A device may therefore record events progressively earlier or later than the true time.

Clock drift can affect event sequence. A device that is two minutes fast may appear to record an action before a related server request. Several small discrepancies can create a misleading timeline if treated as exact.

Investigators should ask whether the device or server used a time-synchronisation service and whether any errors were recorded. If the system is still available, record its current time against a reliable reference, but do not assume the same offset applied historically.

Look for evidence of earlier synchronisation events, clock corrections, restarts or manual changes. Compare repeated events with reliable external timestamps to see whether the offset changed over time.

Where drift cannot be measured precisely, report the possible uncertainty rather than applying an unsupported correction.

Operational takeaway¶

Clock drift can move recorded times progressively away from real time, so investigators should examine synchronisation history and report uncertainty rather than assuming every system clock was exact.