1 A gallery of formats
Time stamps are highlighted, important fields in green. Read each with its documentation open; field order is configurable in most products.
Syslog (BSD style, RFC 3164)
No year, no time zone: both come from the context. The newer RFC 5424 form writes
2026-03-10T07:58:12.120+01:00 instead.
Web server access log (Apache "combined")
Client address, time with offset, request line, status, response size, referrer, user agent.
Web proxy (squid native)
Epoch time of the end of the request, duration in ms, client, result, bytes, method, URL, user.
Many sites change the format (logformat); the configuration file says what each column is.
Windows Security event (forwarded as JSON)
DHCP server (Windows)
Event 10 = new lease, 11 = renewal. Local time, US date order (month first).
Door access control (CSV export)
Usually the controller's local wall-clock time, and door controllers are notorious for clocks that are not synchronised.
2 Windows logon events
| Event ID | Meaning |
|---|---|
| 4624 / 4625 | Logon succeeded / failed (written by the computer that checks the logon) |
| 4634 / 4647 | Logoff / user-initiated logoff |
| 4740 | Account locked out (on the domain controller) |
| 4800 / 4801 | Workstation locked / unlocked |
| 4768 / 4771 | Kerberos ticket requested / pre-authentication failed (domain controller) |
The logon type says how the user logged on, and therefore where they were:
| Type | Name | Typical situation |
|---|---|---|
| 2 | Interactive | At the keyboard of that computer (console) |
| 3 | Network | Access to a share or service over the network |
| 4 / 5 | Batch / Service | Scheduled task / service account |
| 7 | Unlock | Unlocking the screen |
| 10 | RemoteInteractive | Remote Desktop (RDP) |
| 11 | CachedInteractive | Console logon with cached credentials (laptop offline) |
For failed logons, SubStatus gives the reason: 0xC000006A wrong password,
0xC0000064 unknown user, 0xC0000234 account locked, 0xC0000072 account disabled.
A burst of wrong passwords for one account from one address is guessing; wrong passwords for many accounts is spraying.
3 Putting everything on one clock
Three different problems hide in every time stamp:
- Format and zone. Epoch values and ISO stamps ending in
Zare UTC. A stamp without a zone is in whatever zone the system was set to, which you have to find out. Daylight saving time makes some local times impossible (the hour skipped in spring) and others ambiguous (the hour repeated in autumn). - Which moment. Start or end of the event? Proxy and flow logs often write the end; the start is end minus duration.
- Clock error. A clock that is 47 seconds fast writes every event 47 seconds late. Measure each source
against a reference (for example with
ntpdate -qor the system's NTP status) and record the offset with the date you measured it, then correct.
Time stamp normaliser
Try Mar 29 02:30:00 in Europe/Berlin, or ISO 2026-10-25 02:30, and the epoch
value 1773480600.
4 Joining sources: from address to person
Attribution is a chain. Each link comes from a different log, needs its own time window, and can break:
at that time
CCTV, interview
- Addresses move. A DHCP lease is valid for a time; the same address can belong to another device an hour later. NAT puts many devices behind one address.
- Accounts are shared. A password written down, a session left unlocked, a service account: the account is not always its owner.
- Cards and phones are lent. A badge or a phone shows where an object was. Two independent objects of the same person at the same place make a much stronger case than one.
- Absence is evidence too. If a person's own devices show them elsewhere at the same time, record it.
5 Try it yourself
Use the normaliser above where it helps.
A door controller's clock is 47 seconds fast. Its log says 07:58:30. At what time did the door
really open (same zone, hh:mm:ss)?
A fast clock shows times that are too late.
07:58:30 − 47 s = 07:57:43. Write both in your report: the raw value and the corrected one, with the measured offset.
A proxy log line starts with 1773480600.000. Which UTC date and time is that (YYYY-MM-DD hh:mm:ss)?
Choose "Unix epoch seconds" in the normaliser and set the clock error to 0.
2026-03-14 09:30:00 UTC (10:30:00 in Berlin). Epoch time is always UTC; only the display adds a zone.
Which logon type does a 4624 event show for a Remote Desktop session?
See the table in section 2.
10 (RemoteInteractive). Type 2 would mean someone at the console of that machine.
A log line without a zone says 2026-03-29 02:30:00 and the system was set to Europe/Berlin. What is it in UTC?
Daylight saving time starts in the EU on the last Sunday of March at 02:00 local time.
On 29 March 2026 the clocks jump from 02:00 to 03:00 CEST, so 02:30 does not exist. The system was set to another zone, ignored DST, or its clock was wrong. Find out before you use the time.
Binary time stamps work the same way. These are the first 8 bytes of a pcap record header: seconds and microseconds since 1970, little-endian. Edit them and watch the decoded time:
- Change the first byte from
98toD4. How many seconds later is the packet now? - Reset, then add one to the fourth byte (
69→6A). Why does the date jump by more than six months?