RE: Questions about PC clock operations

[Dave Lapsley <DLapsley () cra com>]

Hi Tony,

Actually, that's not quite right.  

Most PCs don't calculate time based on processor cycles, but use a software
clock that counts the number of cycles from a separate oscillator (typically
around 32 kHz).  There is also a separate hardware clock that is used to
maintain timing information across reboots (it has a battery backup).  This
is used to initialize the software clock.

As has been discussed, the accuracy and stability of these oscillators and
clocks is pretty horrible.  Hence the need for NTP and atomic clock-based
NTP servers to discipline regular PC clocks to ensure they don't drift too
much.

The procedure you outlined below is being used by some people for highly
accurate software clocks :-)  They use the TSC register in Intel processors
to count processor cycles.  I've added a link below to a paper that
describes this.  These folks use these clocks for high precision timing for
time-tagging network packets for analysis.  Their work was initially done on
UNIX, but I don't see any reason why it couldn't be done on Windows.

Here are some links that may be of interest:

http://www.beaglesoft.com/mainfaqclock.htm#clocks%20in%20pc
http://www.cubinlab.ee.mu.oz.au/~darryl/tscclock_final.pdf

Hope that's helpful!

Dave.

> -----Original Message-----
> From: tony barry [mailto:tony () no-bull co nz] 
> Sent: Tuesday, August 29, 2006 9:18 PM
> To: ricci () cse ust hk
> Cc: security-basics () securityfocus com
> Subject: Re: Questions about PC clock operations
>
> Hi,
>
> To the best of my knowledge the PC calculates time by simply 
> counting the number of cycles of its timing (do not confuse 
> this term or references to clock pulses with actual time 
> measurement) oscillator. So if your PC has a clock speed of 
> 100Mhz (100 million cycles per second) then when the software 
> which is calculating real time has counted 100 million pulses 
> it increments its real time clock by 1 second. The problem is 
> that the oscillators in computers are not absolutely accurate 
> or stable (and it is not necessary for them to be so for the 
> computer to
> operate) so the oscillator may be running at 100,000,100 
> cycles per second. The software counts 100,000,000 pulses and 
> increments its 1 sec counter but is too early by 100 / 
> 100,000,100 seconds which is a fairly small error but 
> repeated every second it becomes significant. Now we will 
> complicate things further by adding in some temperature drift 
> lets say 10 cycles per second per 1 degree C change in 
> temperature and there you have your drifting clock.
> It should be clear from the above that the drifting clock has 
> nothing to do with the OS.
>
> Hope this helps.
>
> Tony
>
> On Tue, 2006-08-29 at 06:05 +0800, ricci () cse ust hk wrote:
> > Hello All,
> >
> > As you know time is a piece of information critical to digital 
> > forensics investigation. However, as the paper in DFRWS 
> 2006 pointed 
> > out, the PC clock is not steady but drifting.
> >
> > So can any one let me know how the PC clock operates? Is there any 
> > difference between the time between Linux clock and 
> Windows? Will the 
> > operating system be affecting the clock?
> >
> > Please advise.
> >
> > Thx.
> >
> > Ricci
> ----------------------------------------------------------------------
> > ----- This list is sponsored by: Norwich University
> >
> > EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINE 
> The NSA has 
> > designated Norwich University a center of Academic Excellence in 
> > Information Security. Our program offers unparalleled Infosec 
> > management education and the case study affords you 
> unmatched consulting experience.
> > Using interactive e-Learning technology, you can earn this esteemed 
> > degree, without disrupting your career or home life.
> >
> > http://www.msia.norwich.edu/secfocus
> ----------------------------------------------------------------------
> > -----
> --
> No Bull Services Ltd
> PO Box 51528
> Pakuranga
> Auckland
>
> 021 413642  09 5768552
>
> http://www.no-bull.co.nz
>
> This e-mail and any attached files transmitted with it are 
> confidential and intended solely for the use of the 
> addressees. If you have recieved this e-mail in error please 
> inform the sender by sending a reply and delete this message.
>
> --------------------------------------------------------------
> -------------
> This list is sponsored by: Norwich University
>
> EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINE 
> The NSA has designated Norwich University a center of 
> Academic Excellence in Information Security. Our program 
> offers unparalleled Infosec management education and the case 
> study affords you unmatched consulting experience. 
> Using interactive e-Learning technology, you can earn this 
> esteemed degree, without disrupting your career or home life.
>
> http://www.msia.norwich.edu/secfocus
> --------------------------------------------------------------
> -------------

Attachment: Dave Lapsley.vcf
Description:

---------------------------------------------------------------------------
This list is sponsored by: Norwich University

EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINE
The NSA has designated Norwich University a center of Academic Excellence 
in Information Security. Our program offers unparalleled Infosec management 
education and the case study affords you unmatched consulting experience. 
Using interactive e-Learning technology, you can earn this esteemed degree, 
without disrupting your career or home life.

http://www.msia.norwich.edu/secfocus
---------------------------------------------------------------------------