RE: Questions about PC clock operations

Ricci,

In a corporate environment you would typically deploy a network time
protocol server (NTP). The NTP server either points to an external
reference NTP server, or to its own BIOS clock if corporate policy
prevents synching to an external time source.

Then, all *nix computers and all appliances, firewalls, IDS, routers,
etc. are pointed to the NTP server. You would also specify the NTP
server as the time source in the appropriate reg key on your Windows
domain controllers. Typically, the DC running the FSMO role for PDC
Emulator is also the NTP server.

When a Windows client logs in, it checks it's time against the DC, and
adjusts accordingly. You can find the exact way a Windows client
adjusts itself on the Microsoft site, I know it's there somewhere as I
had to do this years ago. The formula depends on how far out of
agreement the client is.

It is very important that all of your devices agree what time something
occurred on your network, and the NTP server is the way you do that.

Best Regards,
Scott Ramsdell

-----Original Message-----
From: ricci@xxxxxxxxxx [mailto:ricci@xxxxxxxxxx]
Sent: Monday, August 28, 2006 5:05 PM
To: security-basics@xxxxxxxxxxxxxxxxx
Subject: Questions about PC clock operations

Hello All,

As you know time is a piece of information critical to digital forensics
investigation. However, as the paper in DFRWS 2006 pointed out, the PC
clock is not steady but drifting.

So can any one let me know how the PC clock operates? Is there any
difference between the time between Linux clock and Windows? Will the
operating system be affecting the clock?

Please advise.

Thx.

Ricci


------------------------------------------------------------------------
---
This list is sponsored by: Norwich University

EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINE
The NSA has designated Norwich University a center of Academic
Excellence
in Information Security. Our program offers unparalleled Infosec
management
education and the case study affords you unmatched consulting
experience.
Using interactive e-Learning technology, you can earn this esteemed
degree,
without disrupting your career or home life.

http://www.msia.norwich.edu/secfocus
------------------------------------------------------------------------
---


---------------------------------------------------------------------------
This list is sponsored by: Norwich University

EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINE
The NSA has designated Norwich University a center of Academic Excellence
in Information Security. Our program offers unparalleled Infosec management
education and the case study affords you unmatched consulting experience.
Using interactive e-Learning technology, you can earn this esteemed degree,
without disrupting your career or home life.

http://www.msia.norwich.edu/secfocus
---------------------------------------------------------------------------

Relevant Pages

  • Re: Frequent time reset messages
    ... Bob, the system clock may be broken for SMP, or your hardware may be ... > Symmetricon XLI-GPS stratum-1 NTP server on an isolated network. ...
    (comp.protocols.time.ntp)
  • RE: [fw-wiz] Acqusition of time
    ... >> drifting as per the normal accuracy of the hardware clock, ... servers in a thermally controlled server room. ... > | after no network time input for nearly three months, ... > So, if a firewall can't reach an NTP server a longer time, I ...
    (Firewall-Wizards)
  • Re: LAN synch question
    ... The ntp server uses its own system clock ... You have run ntpdc against the client and ntpq against the server, probably at slightly different times, as well. ... You only get away with it because there is a built in bias against the local clock, even though its stratum favours it. ...
    (comp.protocols.time.ntp)
  • Re: ntp support installation
    ... to set up your time according to Ubuntu's NTP server. ... ntpdate is a bit of a blunt instrument - it can only adjust the time ... It calculates the drift of your system clock and continuously ...
    (Ubuntu)
  • Re: Time/Date via Gnome clock app (sid)
    ... clock application. ... Now it seems that the NTP server has gone offline and the displayed time ... time-admin using gksu. ...
    (Debian-User)