Timestamp evidence correlation by model based clock hypothesis testing
Svein Yngvar Willassen · 2008
Timestamps play an important role in digital investigations, since they are necessary for the correlation of evidence from different sources, including network tracing. Use of timestamps as evidence can be questionable due to the reference to a clock with unknown adjustment. This work addresses this