Could a device clock be wrong?¶

Yes. A device clock can be wrong by seconds, minutes, hours or even days.

That can affect every timestamp the device creates.

Avoid this assumption: That a timestamp taken directly from a device must reflect the correct real-world time. It may not.

A device clock can be set manually, configured to the wrong time zone, left unchanged after travel or affected by a failed battery, software fault or loss of synchronisation. Some devices also retain incorrect time after being powered off for a long period.

Managed computers often use a network time service, but synchronisation can fail. Mobile devices usually update automatically, yet users may disable automatic time or the device may temporarily lose network access.

An incorrect clock can make an event appear before or after related activity recorded elsewhere. It can also place activity on the wrong date, particularly where the error combines with a time-zone difference.

Investigators should not simply correct the timestamp because another record looks more reliable. First establish which clock produced it and whether there is evidence of the offset at the relevant time.

Where the device is available, record its current displayed time, time zone and automatic-time settings against a reliable reference. But remember that the current error may not be the same as the historical error.

Look for time-synchronisation events, manual clock changes, restarts and repeated comparisons with reliable external records. A consistent offset across several events may support a reasoned correction, while a changing offset may indicate drift or intermittent synchronisation.

Operational takeaway¶

A device timestamp may be wrong because of configuration, drift, manual change or failed synchronisation, so investigators should establish the clock’s reliability before treating the recorded time as exact.