While working on an investigation, a colleague hands you a list of file creation and access times taken from a compromised workstation. To match the times with file access and creation times from other systems, what do you need to account for

Record time offsets.

Explanation:

In this scenario, to match the times with file access and creation times from other systems, you will need to account for time offsets.

The time offset refers to the time stamp associated with different processes or tasks on a computer in nanoseconds through the operating system.

Since you've been handed a list of file creation and access times taken from a compromised workstation by your colleague, you'll need to match respectively the time the file was created to the time it was accessed by an unauthorized user.

Additionally, the time stamp varies depending on the operating system being used;

- For windows operating system, it uses a 64 bit time stamp.

- For Linux or Unix, it uses a 32 bit time stamp.

is this supposed to be a question ?

answerlibraries;