Hi Tony,
Actually, that's not quite right.
Most PCs don't calculate time based on processor cycles, but use a software
clock that counts the number of cycles from a separate oscillator (typically
around 32 kHz). There is also a separate hardware clock that is used to
maintain timing information across reboots (it has a battery backup). This
is used to initialize the software clock.
As has been discussed, the accuracy and stability of these oscillators and
clocks is pretty horrible. Hence the need for NTP and atomic clock-based
NTP servers to discipline regular PC clocks to ensure they don't drift too
much.
The procedure you outlined below is being used by some people for highly
accurate software clocks :-) They use the TSC register in Intel processors
to count processor cycles. I've added a link below to a paper that
describes this. These folks use these clocks for high precision timing for
time-tagging network packets for analysis. Their work was initially done on
UNIX, but I don't see any reason why it couldn't be done on Windows.
Here are some links that may be of interest:
http://www.beaglesoft.com/mainfaqclock.htm#clocks%20in%20pc
http://www.cubinlab.ee.mu.oz.au/~darryl/tscclock_final.pdf
Hope that's helpful!
Dave.
-----Original Message-----
From: tony barry [mailto:tony@no-bull.co.nz]
Sent: Tuesday, August 29, 2006 9:18 PM
To: ricci@cse.ust.hk
Cc: security-basics@securityfocus.com
Subject: Re: Questions about PC clock operations
Hi,
To the best of my knowledge the PC calculates time by simply
counting the number of cycles of its timing (do not confuse
this term or references to clock pulses with actual time
measurement) oscillator. So if your PC has a clock speed of
100Mhz (100 million cycles per second) then when the software
which is calculating real time has counted 100 million pulses
it increments its real time clock by 1 second. The problem is
that the oscillators in computers are not absolutely accurate
or stable (and it is not necessary for them to be so for the
computer to
operate) so the oscillator may be running at 100,000,100
cycles per second. The software counts 100,000,000 pulses and
increments its 1 sec counter but is too early by 100 /
100,000,100 seconds which is a fairly small error but
repeated every second it becomes significant. Now we will
complicate things further by adding in some temperature drift
lets say 10 cycles per second per 1 degree C change in
temperature and there you have your drifting clock.
It should be clear from the above that the drifting clock has
nothing to do with the OS.
Hope this helps.
Tony
On Tue, 2006-08-29 at 06:05 +0800, ricci@cse.ust.hk wrote:
Hello All,
As you know time is a piece of information critical to digital
forensics investigation. However, as the paper in DFRWS
2006 pointed
out, the PC clock is not steady but drifting.
So can any one let me know how the PC clock operates? Is there any
difference between the time between Linux clock and
Windows? Will the
operating system be affecting the clock?
Please advise.
Thx.
Ricci
----------------------------------------------------------------------
----- This list is sponsored by: Norwich University
EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINE
The NSA has
designated Norwich University a center of Academic Excellence in
Information Security. Our program offers unparalleled Infosec
management education and the case study affords you
unmatched consulting experience.
Using interactive e-Learning technology, you can earn this esteemed
degree, without disrupting your career or home life.
http://www.msia.norwich.edu/secfocus
----------------------------------------------------------------------
-----
--
No Bull Services Ltd
PO Box 51528
Pakuranga
Auckland
021 413642 09 5768552
http://www.no-bull.co.nz
This e-mail and any attached files transmitted with it are
confidential and intended solely for the use of the
addressees. If you have recieved this e-mail in error please
inform the sender by sending a reply and delete this message.
--------------------------------------------------------------
-------------
This list is sponsored by: Norwich University
EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINE
The NSA has designated Norwich University a center of
Academic Excellence in Information Security. Our program
offers unparalleled Infosec management education and the case
study affords you unmatched consulting experience.
Using interactive e-Learning technology, you can earn this
esteemed degree, without disrupting your career or home life.
http://www.msia.norwich.edu/secfocus
--------------------------------------------------------------
-------------
Dave Lapsley.vcf
Description: Binary data
---------------------------------------------------------------------------
This list is sponsored by: Norwich University
EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINE
The NSA has designated Norwich University a center of Academic Excellence
in Information Security. Our program offers unparalleled Infosec management
education and the case study affords you unmatched consulting experience.
Using interactive e-Learning technology, you can earn this esteemed degree,
without disrupting your career or home life.
http://www.msia.norwich.edu/secfocus
---------------------------------------------------------------------------
