RE: Questions about PC clock operations

Hi Tony,

Actually, that's not quite right.

Most PCs don't calculate time based on processor cycles, but use a software
clock that counts the number of cycles from a separate oscillator (typically
around 32 kHz). There is also a separate hardware clock that is used to
maintain timing information across reboots (it has a battery backup). This
is used to initialize the software clock.

As has been discussed, the accuracy and stability of these oscillators and
clocks is pretty horrible. Hence the need for NTP and atomic clock-based
NTP servers to discipline regular PC clocks to ensure they don't drift too
much.

The procedure you outlined below is being used by some people for highly
accurate software clocks :-) They use the TSC register in Intel processors
to count processor cycles. I've added a link below to a paper that
describes this. These folks use these clocks for high precision timing for
time-tagging network packets for analysis. Their work was initially done on
UNIX, but I don't see any reason why it couldn't be done on Windows.

Here are some links that may be of interest:

http://www.beaglesoft.com/mainfaqclock.htm#clocks%20in%20pc
http://www.cubinlab.ee.mu.oz.au/~darryl/tscclock_final.pdf

Hope that's helpful!

Dave.

-----Original Message-----
From: tony barry [mailto:tony@xxxxxxxxxxxxx]
Sent: Tuesday, August 29, 2006 9:18 PM
To: ricci@xxxxxxxxxx
Cc: security-basics@xxxxxxxxxxxxxxxxx
Subject: Re: Questions about PC clock operations

Hi,

To the best of my knowledge the PC calculates time by simply
counting the number of cycles of its timing (do not confuse
this term or references to clock pulses with actual time
measurement) oscillator. So if your PC has a clock speed of
100Mhz (100 million cycles per second) then when the software
which is calculating real time has counted 100 million pulses
it increments its real time clock by 1 second. The problem is
that the oscillators in computers are not absolutely accurate
or stable (and it is not necessary for them to be so for the
computer to
operate) so the oscillator may be running at 100,000,100
cycles per second. The software counts 100,000,000 pulses and
increments its 1 sec counter but is too early by 100 /
100,000,100 seconds which is a fairly small error but
repeated every second it becomes significant. Now we will
complicate things further by adding in some temperature drift
lets say 10 cycles per second per 1 degree C change in
temperature and there you have your drifting clock.
It should be clear from the above that the drifting clock has
nothing to do with the OS.

Hope this helps.

Tony

On Tue, 2006-08-29 at 06:05 +0800, ricci@xxxxxxxxxx wrote:
Hello All,

As you know time is a piece of information critical to digital
forensics investigation. However, as the paper in DFRWS
2006 pointed
out, the PC clock is not steady but drifting.

So can any one let me know how the PC clock operates? Is there any
difference between the time between Linux clock and
Windows? Will the
operating system be affecting the clock?

Please advise.

Thx.

Ricci



----------------------------------------------------------------------
----- This list is sponsored by: Norwich University

EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINE
The NSA has
designated Norwich University a center of Academic Excellence in
Information Security. Our program offers unparalleled Infosec
management education and the case study affords you
unmatched consulting experience.
Using interactive e-Learning technology, you can earn this esteemed
degree, without disrupting your career or home life.

http://www.msia.norwich.edu/secfocus

----------------------------------------------------------------------
-----
--
No Bull Services Ltd
PO Box 51528
Pakuranga
Auckland

021 413642 09 5768552

http://www.no-bull.co.nz

This e-mail and any attached files transmitted with it are
confidential and intended solely for the use of the
addressees. If you have recieved this e-mail in error please
inform the sender by sending a reply and delete this message.

--------------------------------------------------------------
-------------
This list is sponsored by: Norwich University

EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINE
The NSA has designated Norwich University a center of
Academic Excellence in Information Security. Our program
offers unparalleled Infosec management education and the case
study affords you unmatched consulting experience.
Using interactive e-Learning technology, you can earn this
esteemed degree, without disrupting your career or home life.

http://www.msia.norwich.edu/secfocus
--------------------------------------------------------------
-------------


Attachment: Dave Lapsley.vcf
Description: Binary data

---------------------------------------------------------------------------
This list is sponsored by: Norwich University

EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINE
The NSA has designated Norwich University a center of Academic Excellence
in Information Security. Our program offers unparalleled Infosec management
education and the case study affords you unmatched consulting experience.
Using interactive e-Learning technology, you can earn this esteemed degree,
without disrupting your career or home life.

http://www.msia.norwich.edu/secfocus
---------------------------------------------------------------------------

Relevant Pages

  • Re: Accurate(ish) frequency measurement
    ... The simple method - counting cycles - would sort of work. ... clock to measure things more accurately isn't too feasable. ... an interpolator will find Delta_T1 = the time from the active ... edge of the gate to the next active edge of the unknown clock. ...
    (sci.electronics.design)
  • Re: Division by Zero in Nature, and Decomposition of Time.
    ... It *starts* with cycles, historically, but is not ... "the whole universe" to build a clock, ... > they would be either zero or very near zero relative to everything ... > that they simply do not exist relative to an observer such as us. ...
    (sci.math)
  • Re: 8051 architecture
    ... design philosophies from traditional to soft cores fro ASICs. ... Some do run in 2 clock cycles per machine state. ...
    (comp.arch.embedded)
  • Re: On synchronization methods across clock domains
    ... What happens when the dstclk samples some changing bits in one cycle and the rest in the next? ... If your wire foo is used to validate the data is steady for two cycles - which isn't clear since your two_reg_synchronizer module isn't obvious - then this technique actually is recommended. ... You effectively have a slower domain being sampled by a higher speed domain since your srcclk signal lasts 8 clocks. ... I have a source clock, srcclk, which can be as slow as 1000 ...
    (comp.lang.verilog)
  • Re: Need DSP recommendation
    ... > headers etc, the bit banger would have to operate around 1 MHz clock ... Thus, for each sample, the bit banger would have to run 20 ... > cycles, so the number of cycles for bit banging would be less. ...
    (comp.arch.embedded)