The reliability of clocks as digital evidence under low voltage conditions

Abstract

Battery powered electronic devices like mobile phones are abundant in the world today, and such devices are often subject to digital forensic examinations. In this paper, we show that the assumptions that clocks are close to correct can be misleading under some circumstances, especially with failing batteries. One of four tested devices showed the clock jumped 8 and 12 years into the future when the battery connector voltage was held at 2.030 V and 2.100 V for about 9 s. Other devices showed a more expected behavior, where the clocks were slowly lagging until it was reset. In addition to this, we tested the precision of some methods of documenting the clock settings, and found most timestamps to be within reasonable precision for forensic use. Finally, we describe a model for the variability of the timestamps examined.