Which timestamp in a mobile report should I use?¶

title: Which timestamp in a mobile report should I use? subtitle: Use the timestamp that answers the investigative question, not simply the first date displayed by the reader. slug: which-timestamp-in-a-mobile-report-should-i-use series: mobile-extraction-and-reader-reports section: timestamps-and-timelines card_type: question_card content_type: core-operational risk_level: high-risk pathway_order: 41 section_order: 1 status: draft owner: IF Digital last_updated: '2026-07-25' version: '0.1' review_gate: pending review_mode: ai-assisted review_timebox_mins: 60 qa_gate: pending qa_count: 0 pipeline_ref: PIPELINE_PRG_001 pipeline_version: '1.1' public_safe: true video_ready: true word_count: 478 estimated_read_time_seconds: 198 audiences: - investigator - supervisor - fraud and compliance practitioner tags: - mobile evidence - timestamps - timeline - event time - interpretation sources: - title: SWGDE Best Practices for Mobile Device Forensic Analysis url: https://www.swgde.org/documents/published-complete-listing/20-f-005-swgde-best-practices-for-mobile-device-forensic-analysis/ - title: 'NIST SP 800-101 Rev. 1: Guidelines on Mobile Device Forensics' url: https://csrc.nist.gov/pubs/sp/800/101/r1/final - title: 'NIST Computer Forensics Tool Testing: Mobile Devices' url: https://www.nist.gov/itl/csd/secure-systems-and-applications/computer-forensics-tool-testing-program-cftt/cftt-7

Which timestamp in a mobile report should I use?¶

Use the timestamp that answers the investigative question, not simply the first date displayed by the reader.

Script¶

A mobile report may show several dates and times for one artefact.

The correct timestamp is the one that represents the event you are trying to describe.

Start with the investigative question.

Are you trying to establish when a message was created, submitted, delivered, read, edited or deleted?

When a photograph was captured, copied, modified or imported?

When an application record was created, updated or synchronised?

When a file appeared on the handset?

Those are different events.

A report may display one friendly time at the top of the artefact while hiding other fields in the details panel.

Don't assume the most prominent value is automatically “the time it happened”.

Identify the source field.

Was the value stored by the application, file system, operating system, cloud service or forensic tool?

Is it an original numeric timestamp that the reader converted for display?

Was it inferred from a file name or another record?

Was it recovered from a database journal or backup?

Then identify the event meaning.

A message database may contain creation, server, delivery and read times.

A file may have created, modified and accessed times.

A browser artefact may contain visit, download and last-synchronised times.

A photograph may have capture metadata alongside file-system times.

Use the event that matches the proposition.

If you are saying when a photograph was taken, the camera capture time may be more relevant than the date the file was imported.

If you are saying when a message reached a recipient, a delivery or recipient-side record is more relevant than the sender’s local creation time.

Now check the timezone basis.

Was the value stored in UTC, local time, a fixed offset or an application-specific format?

Did the report convert it into the reviewer’s current timezone?

Was daylight saving applied?

If the basis is unknown, don't silently label the displayed value as local time.

Record uncertainty and ask the examiner where necessary.

Also compare other records.

Does the timestamp fit the surrounding conversation, notifications, provider records, file sequence and device activity?

A single anomalous value may reflect a wrong device clock, parser issue, synchronisation delay or different event field.

The common mistake is:

“The report says 14:32, so the user acted at 14:32.”

The report may be displaying a converted server time, file modification time or synchronisation event.

Another mistake is to avoid choosing any timestamp because several exist.

The solution is to name the event and source.

A careful chronology entry might say:

“14:32:18 BST — the application database records the message as submitted by account A.”

Or:

“13:32:18 UTC stored value, displayed by the reader as 14:32:18 BST.”

That allows another person to understand and reproduce the conversion.

Use the timestamp that answers the question.

State what it represents.

And keep the human action separate unless the surrounding evidence supports that next step.

Name the event represented by the timestamp, its stored basis and the display timezone before using it in a chronology.

Related questions¶

• Why can one artefact show several different times?
• Is the timestamp stored in UTC or local time?
• What does a timestamp prove about when a person acted?

Source notes¶

• SWGDE Best Practices for Mobile Device Forensic Analysis
• NIST SP 800-101 Rev. 1: Guidelines on Mobile Device Forensics
• NIST Computer Forensics Tool Testing: Mobile Devices