Forensic Documentation Tool
This forensic documentation tool is used to document the system date and
system time settings of the subject computer. File dates and times
associated with allocated files and previously deleted files can be
important in cases involving computer evidence. The reliability of the file
dates and times are directly tied to the accuracy of the system settings for
date and time on the subject computer. Therefore, it is important to
document the accuracy of the system clock as soon as possible. Low battery
power or day light savings time changes are likely sources of system clock
inaccuracies. This program aids in the documentation of the system clock
settings for time and date. When the dates and times that files were created,
modified or last accessed, this information is relevant.
NTI recommends that this tool be used when computers are seized
as evidence by law enforcement. For that reason, NTI makes this
software available to law enforcement computer crime specialists
free of charge to help stretch limited law enforcement budgets.
The program and its uses are described in
Computer Forensics, Incident Response Essentials by Warren G. Kruse II and Jay G. Heiser
Cybersecurity Operations Handbook by Dr. John W. Rittinghouse and Dr. William M. Hancock.
NTI recommends that this software tool be used in conjunction with
an accurate time piece or an Internet source that provides the
accurate time. Once source of accurate time is
which is provided by the two time agencies of United States: a Department
of Commerce agency, the National Institute of Standards and
Technology (NIST), and its military counterpart, the U. S.
Naval Observatory (USNO). Inexpensive time pieces can also
be purchased that automatically verify the accuracy of time
settings from these sources. NTI recommends some of the newer
battery operated travel clocks that have this feature and they
are inexpensive, e.g., under $15 and they can be purchased at
most electronics stores and even some retail drug stores in the
GetTime Software - Primary Use:
- Used to capture the current system settings for date and time on a computer that has been
seized as evidence.
- Used to document the differences between the system clock and the true time and
GetTime Software - Program Features and Benefits:
- DOS based for ease of operation and speed.
- No Software Dongle! - We know that software dongles get in the way and they restrict your ability to process several computers at the same time. That is why NTI does not use software dongles and our licensing of this software allows you to process multiple computers at the same time. NTI's goal is to make your life easier and this software was designed with ease of use in mind.
- Compact program size which easily fits on one floppy diskette with other forensic
- Does not write to the subject hard disk drive unless requested by the operator of the
- Creates a word processing compatible file for ease of documentation.
Back To NTI's Home Page
Please direct E-Mail to
Copyright © 2004 by New Technologies Armor, January 16, 2004