Why can one artefact show several different times?¶
title: Why can one artefact show several different times? subtitle: One item can pass through creation, modification, transmission, storage, synchronisation and display stages. slug: why-can-one-artefact-show-several-different-times series: mobile-extraction-and-reader-reports section: timestamps-and-timelines card_type: question_card content_type: foundation risk_level: normal pathway_order: 42 section_order: 2 status: draft owner: IF Digital last_updated: '2026-07-25' version: '0.1' review_gate: pending review_mode: ai-assisted review_timebox_mins: 30 qa_gate: pending qa_count: 0 pipeline_ref: PIPELINE_PRG_001 pipeline_version: '1.1' public_safe: true video_ready: true word_count: 442 estimated_read_time_seconds: 183 audiences: - investigator - supervisor - fraud and compliance practitioner tags: - mobile evidence - multiple timestamps - creation time - synchronisation - artefact lifecycle sources: - title: SWGDE Best Practices for Mobile Device Forensic Analysis url: https://www.swgde.org/documents/published-complete-listing/20-f-005-swgde-best-practices-for-mobile-device-forensic-analysis/ - title: 'NIST SP 800-101 Rev. 1: Guidelines on Mobile Device Forensics' url: https://csrc.nist.gov/pubs/sp/800/101/r1/final
Why can one artefact show several different times?¶
One item can pass through creation, modification, transmission, storage, synchronisation and display stages.
Script¶
One mobile artefact can legitimately contain several different timestamps.
That usually means the item passed through several stages.
Take a message.
It may have:
a local draft creation time;
a submission time;
a server acceptance time;
a delivery time;
a recipient-device time;
a read time;
an edit time;
and a deletion time.
Those values may be close together or separated by hours or days.
A photograph may have:
a camera capture time;
an embedded metadata time;
a file-system creation time;
a modification time;
an import time;
a cloud upload time;
and a download time on another device.
A document may be created on a computer, edited in the cloud and later synchronised to the phone.
The handset file times may describe the synchronised copy rather than the original creation.
Databases add more layers.
A row may contain the event time recorded by the application.
The database file itself may have a modification time showing when any row in the database changed.
A journal may preserve an earlier version.
A backup may record when the database was copied.
The reader may display all of these if the parser exposes them.
The values can also use different time standards.
One may be stored in UTC.
Another may be local device time.
A server may attach a fixed offset.
A file system may store UTC while the application stores a local wall-clock value without an offset.
The reader then converts some or all of them for display.
This can make correct values look inconsistent.
The first step is to label each timestamp.
Don't call them Time 1 and Time 2.
Record the source and event:
message creation;
server submission;
delivery;
database modification;
file creation;
backup;
or synchronisation.
Then compare the sequence.
Does the order make operational sense?
A created time should usually precede delivery.
A cloud download may occur long after capture.
A file modification time may occur after import.
Where the sequence is impossible, investigate clock error, timezone conversion, parser interpretation, recovered data or incorrect field labels.
The common mistake is:
“The timestamps disagree, so the report is unreliable.”
The values may be describing different events.
Another mistake is:
“The earliest time must be the original event.”
An inherited metadata field or wrong device clock can be earlier than the real-world action.
A careful explanation might say:
“The photograph metadata records capture at 10:12 UTC. The file-system creation time of 14:40 UTC reflects later download to this handset.”
That resolves the apparent contradiction.
Several timestamps are not noise.
They can reveal the lifecycle of the artefact.
The task is to identify which system created each value and which event it describes.
Key takeaway
Several timestamps often describe several stages of one item rather than a contradiction.
Related questions¶
- Which timestamp in a mobile report should I use?
- What is the difference between created, modified, accessed and received time?
- Why might an application timestamp differ from the phone timestamp?
Source notes¶
- SWGDE Best Practices for Mobile Device Forensic Analysis
- NIST SP 800-101 Rev. 1: Guidelines on Mobile Device Forensics