@kfalconspb We (@zubairbaigPerth & I) have a paper using 3rd party timing data to verify internal clocks. Network artefacts often contain a time stamp in a cookie or http headers which are sprayed all over a hard drive. They can help DFIR investors…
Network and System Security
Springer, Cham