Can the device clock be wrong?¶
Yes. Automatic time reduces error, but it does not prevent manual changes, failed synchronisation, clock drift or differences between device, application and server clocks.
Why the clock may be wrong¶
A device may lack service, location support or current time-zone information. The user may disable automatic time, while a corporate profile, provider restriction, software fault or damaged system can affect what is set. A free-running clock can also gain or lose time gradually while it remains without a reliable update.
The clock may be changed deliberately. New local records may then use the wrong wall-clock value, and the sequence can appear to jump when the device returns to automatic time.
Different records may use different clocks¶
Do not assume every record displayed in an extraction used the handset clock. A locally saved draft may use device time while a delivered message uses server UTC. Photographs, file systems, applications and cloud services may use still other clocks.
These differences can help expose a clock error, but they can also mean that one timestamp needs adjustment while another does not. A timestamp's meaning depends on its source, not only the value displayed in a report.
Test whether the offset applied then¶
Check whether the examiner compared the displayed device time with a reliable reference and recorded the time zone, offset, power state and acquisition conditions. Compare important device events with independently timed provider records, CCTV, payments, network records or server logs.
A consistent difference can support an offset. Do not simply subtract today's observed error from every historical timestamp: the setting, time zone or drift may have changed during the period, and some records may never have used the device clock.
A clear report identifies both the observed offset and the records it may affect. For example:
At acquisition, the handset clock displayed six minutes and twenty seconds ahead of the reference time. Application A uses device time, while Application B records server UTC.
That separates the measured fact from the correction applied to individual records.
Key takeaway
Establish which clock created each important timestamp and corroborate any proposed correction across the relevant period.
Related questions¶
- What happens when the device timezone changes?
- Why might an application timestamp differ from the phone timestamp?
- What does a timestamp prove about when a person acted?
