Clock Skew
Definition
The difference between a device's local clock and a trusted reference time such as UTC. Skew accumulates due to hardware drift, timezone misconfiguration, or deliberate manipulation. Uncorrected skew causes log entries from different sources to appear out of sequence.
- Definition
- Local clock offset from a trusted reference time
- Causes
- Hardware drift, timezone misconfiguration, manipulation
- Effect
- Log entries appear out of sequence
- Relevant field
- Network timeline reconstruction
Common questions
How do investigators correct for clock skew when merging logs from multiple devices?+
They identify events that appear in more than one log source, such as a login recorded on both a firewall and an authentication server, and use the time difference between the matching entries to calculate and apply an offset correction across each device's full log set.
Why is deliberate clock manipulation a concern separate from ordinary drift?+
An attacker who changes a system's clock before or during an intrusion can make their own actions appear to have happened at a different time or blend in among unrelated log entries, which is a form of anti-forensic timestamp manipulation rather than passive hardware drift.
Related terms
- Anchor Event
- A log entry that can be identified with high confidence across two or more log sources, used to verify relative clock offsets...
- DHCP Lease Log
- A record maintained by a Dynamic Host Configuration Protocol server that maps each IP address assignment to the requesting device's MAC address,...
- Log Normalisation
- The conversion of log entries from their native format into a common schema, typically a structured record with a corrected UTC timestamp,...
- NAT (Network Address Translation)
- A mechanism by which a router replaces private source IP addresses with a single public IP address before forwarding packets to the...
- Session Tuple
- The five-element identifier for a network session: source IP, source port, destination IP, destination port, and protocol. The session tuple is the...