Re: Need Help Security issue

From: Barry Margolin (barry.margolin@level3.com)
Date: 03/27/03 

From: Barry Margolin <barry.margolin@level3.com>
Date: Thu, 27 Mar 2003 01:19:56 GMT

In article <lKpga.10268$ns6.555751@news2.east.cox.net>,
Steve <sklives@(remove)cox.net> wrote:
>Are there any traces left on a computer of the time and date websites were
>visited, other than the time stamp left by the local machine.

Web sites may include a last-modified timestamp with a web page that they
send, and the computer might record this. But this may have little
relationship with the time that the person was visiting the web site; it
only puts a lower bound on the time, and for pages that don't change often
it could be days or weeks earlier than the time the site was visited.

Cookies usually have an expiration time on them, which can be expected to
be in the future. So this puts an upper limit on the time he was accessing
the site.

> If someone changed the clock on a computer to a time and date when another
>employee was using the computer. Then the person accesses pornographic
>material leaving hundreds of temporary internet files and cookies on the
>computer for the boss to see. I need to know if there is any way to tell if
>the clock was changed while those porn sites were accessed. Will someone
>please help because a good man's career and family is at stake here!

Detecting changes in the system clock will depend on the OS. 

-- 
Barry Margolin, barry.margolin@level3.com
Genuity Managed Services, Woburn, MA
*** DON'T SEND TECHNICAL QUESTIONS DIRECTLY TO ME, post them to newsgroups.
Please DON'T copy followups to me -- I'll assume it wasn't posted to the group.