Answer:
Record time offsets.
Step-by-step explanation:
In this scenario, to match the times with file access and creation times from other systems, you will need to account for time offsets.
The time offset refers to the time stamp associated with different processes or tasks on a computer in nanoseconds through the operating system.
Since you've been handed a list of file creation and access times taken from a compromised workstation by your colleague, you'll need to match respectively the time the file was created to the time it was accessed by an unauthorized user.
Additionally, the time stamp varies depending on the operating system being used;
- For windows operating system, it uses a 64 bit time stamp.
- For Linux or Unix, it uses a 32 bit time stamp.