Hello, I’m seeing some internet activity in a date that shouldn’t be because no one have access to the maschine. I saw it in timeline and in web history. What are the probablities that the date is wrong? How can I proove that? Is there any accurancy rate in dates for Autopsy that I should consider?
I also saw windows activity while computer is not on, I don’t why is that but I’ve seen it. This is the first time I see the same but with internet activity.
Thank you
Laura
Depending on which browser the web history is coming from you should be able to use another tool to extract the data and validate what you are seeing. Which browser is the data in question coming from?
It was from Google Chrome. How can I extract the data to validate that?
Thank you
What you are likely seeing is Google Chrome syncing with cloud data. I see it all the time: Chrome browser history that is older than the device itself. There is a SyncData.sqlte3 database in a user profile that can shed light on when this syncing occurred.
With the cloud touching more and more areas of computing, we will see more date anomalies that require careful study and explanation before conclusions are drawn.
You can right click on the line with the data in question and extract the SQLite database file to the export directory. You can then use a SQLite database browser or a program that can read the Chrome history file and export the data.
Thanks! Solved by the two last posts.