ZEKASTRA / FORENSIC / Digital time
Three time bases. One carefully stated assumption.
Read how file systems represent time, try exact calculations, compare invented records and produce a transparent technical note.
All examples are fictional and process in this browser. No file is read or uploaded. The tool does not detect timestamp manipulation, validate real evidence or identify a person.
01 / Learn
What a stored timestamp can—and cannot—tell you
| System | Representation | Reference | Typical unit | Interpretation limit |
|---|---|---|---|---|
| Windows / NTFS | FILETIME | 1601-01-01 UTC | 100 ns | Stored in UTC; representation precision does not guarantee observation accuracy. |
| Unix / Linux | Epoch | 1970-01-01 UTC | seconds or milliseconds | The producer must identify the unit and actual source field. |
| FAT / FAT32 | Local last write | Local wall clock | 2 seconds | A fixed UTC offset must be assumed for this example; historic DST and OS cache matter. |
FAT creation timestamps may have 10 ms resolution while last access is a date only (one-day granularity). NTFS last-access updates can be delayed or disabled. File metadata can be modified, copied or misinterpreted, and FAT local timestamps can be affected by daylight-saving conversions.
Technical sources: Microsoft Learn — File Times · FILETIME · GetFileTime
02 / Try
Convert one represented time to UTC
FAT input format: YYYY-MM-DD HH:MM:SS, with an even second (0, 2, 4…). An offset like +03:00 is an explicit assumption, not a reconstructed historical time zone.
03 / Produce
Keep assumptions with the result
Export the visible explanation as a UTF-8 training note. The original value, unit, assumed offset and interpretation limits must remain with any quoted result.
04 / Practice
A fictional three-record timeline
Record A: FAT 2026-10-09 12:07:00 (+03:00 assumed). Record B: Windows FILETIME for 2026-10-09 09:07 UTC. Record C: Unix seconds for two seconds after B. Discover which representations match to the displayed millisecond.
The example does not measure FAT rounding, prove exact physical simultaneity or diagnose tampering.