Cloud Timestamps Are Not Events: Reconstructing Chronology from Digital Evidence

A cloud evidence set may contain several timestamps for what appears to be the same file or object. One may describe when a provider processed a request. Another may have been supplied by a client device. A third may have been created when an export or collection tool wrote the file to local storage. A […]