Meaning
Variance between a computer’s internal time and the accurate time from a reference server can create errors in digital logging. Even high-quality hardware experiences ntp clock drift due to temperature changes or inconsistencies in the power supply to the internal oscillator. When multiple servers in a network drift at different rates, the timestamps they record for the same event will not match.
The drift continues until a synchronization event resets the local clock to the server time.
Variance Cause
A local machine periodically polls a network time protocol server to calculate the offset and adjust its own clock. If the network connection is slow or unstable, the ntp clock drift can accumulate over several days until the error reaches substantial levels. This gap makes it difficult to reconstruct the exact order of operations in a complex distributed system.
Correction Lag
Investigators must account for this time error when they are comparing logs from different devices to build a timeline. A recorded event on one server might appear to happen before its cause on another server because of uncorrected ntp clock drift. Adjusting for these known variances is a standard part of digital evidence analysis.
Accuracy Threshold
Frequent updates are necessary to maintain the integrity of time transactions.
