Got the Time?

Time recording or sequential event recording are two of the most valuable and reliable tools available to investigators. Once an event has occurred, its position in time is forever unchanged. For this reason, a chronological listing of events or a timeline is nearly always helpful in any investigation. In the Watergate hearings, then-Senator Howard Baker concisely emphasized the importance of the timing of events when he asked, "What did he (then-President Nixon) know and when did he know it."

In our information environment with internet protocol, wireless devices, and personal computers, the information gatherer has access to some "invisible" date-time stamps that establish when an event really occurred or didn't occur at all. These stamps are described as "invisible" because they are attached automatically and nearly transparently to the end user of the piece of equipment.

Some examples:

Our cellular telephones date-time stamp such events as power-up, telephone transactions, and cell site and sector handoff. Some cell phone date-time stamps are generated even when calls are not in progress. The data available from a cellular carrier can establish with surprising accuracy where the phone's user was at a particular time.

Files created in personal computers are typically date-time stamped. Some apparent suicides were determined to be homicides when forensic analysis of the computer on which the suicide note was written determined the note was written post mortem. Similarly, some deaths at first believed to be accidental have been ruled suicides when an invisible time stamp revealed a suicide note had been deleted post mortem.

Global positioning system (GPS) navigation equipment is now installed in some rental cars. In some instances, these are used by the renter to help navigate in unfamiliar areas. In other instances, they are not accessible to the renter and are used by the rental company to know where its vehicles are and how they are being driven. In all instances, each data inquiry is date-time stamped. In most but not all instances, it is impossible for the witting or unwitting renter to successfully delete or change any of the information including the date-time stamp.

Some new cars may soon come with a "black box" installed. The box, the automotive equivalent of flight and cockpit voice data recorders present for years in aircraft, will record in time sequence a range of data used to help reconstruct accidents. Here is a relatively simple primer on automobile black boxes and their capabilities.

In our digital information age, there are a wide range of time-stamping devices available to the investigator. These devices can assist in reconstructing the sequence of events in a crime or an accident and in confirming or refuting a suspect's alibi. With all the information that someone can influence or change to support his own story or fabricate a plausible lie, time is the one he is least likely to be able to successfully manipulate.

PS: Notice that according to the visible date-time stamp, this was posted at 06:00 AM on January 24, 2005. A forensic examination of my computer and the blogger.com server, however, would show that it was actually posted at approximately 04:55 PM on January 23, 2005.