Examining a computer
When examining a computer:
clock and time zone:
the system date and time should be collected, preferably from the BIOS.
date and time should be compared to a reliable known time source and any differences noted.
in the triage phase read the OS configured time zone. By default:
Windows OS configures the BIOS clock to local time.
Linux and Mac OS configure the BIOS clock to UTC.
if the BIOS is accessible then:
take note of the drive parameters and boot order.
if present, take note also of system serial numbers, component serial numbers, hardware component hashes, etc
BIOS Access – Warning
Before trying to access the BIOS, first unplug all storage media (SSD, HDD, memory cards, etc) from the computer.
Last updated