Can the device clock be wrong?¶
Yes. A handset clock can be wrong, even with automatic time-setting switched on. It may have been changed, drifted while offline or used the wrong time zone. But the handset clock is only part of the picture: apps and online services can use different clocks.
For each important timestamp, ask which clock supplied the time and what event it records. A saved draft may use the handset clock; a delivered message may carry a separate server time. Both can be useful, but they may time different parts of the same exchange.
One handset can contain several time sources¶
Knowing the clock behind a record helps you put events in order. Your extraction report may convert stored times into one display time zone, but that doesn't mean they all came from one clock.
Jane photographs a damaged door, then messages about it. These fictional extracts show the apparent clash. Her handset was set to UTC throughout.
| Record | Extracted value | What it records |
|---|---|---|
| Photo EXIF (details saved inside the image) | DateTimeOriginal: 2026:01:18 13:56:20 | Capture time; this field alone gives no time zone. |
| Messaging server receipt | 2026-01-18T13:51:00Z | Server received the message; Z means UTC. |
The message appears first. Check the clocks before deciding the story doesn't fit.
Measure how far out the handset is¶
14:00:00 UTC14:06:20+00:06:2018 Jan 2026Here, the handset is six minutes and twenty seconds fast when you acquire it. That's a useful measurement. To use it for Jane's earlier photo, you still need evidence that the same difference applied then. The clock could have changed between the photograph and acquisition.
What does a timestamp prove about when a person acted? explains why a timestamp's meaning also depends on the event that produced it.
Check the stretch of time you need¶
Compare events around the photograph with independently timed records: CCTV showing Jane taking it, for example, or an access-control record of her entering the building. Several matching comparisons can support a correction for that period. If the differences change, look for a clock adjustment or drift.
Show your working¶
With those checks established, a report could say:
At acquisition, the handset was 00:06:20 ahead of UTC. Checks established that the photo used handset time, with the handset set to UTC; independent comparisons supported the same difference during the relevant period. Subtracting 00:06:20 from the recorded capture time of 13:56:20 gives 13:50:00 UTC. The server's message receipt at 13:51:00 UTC was left unchanged.
Keep the extracted values alongside any corrections so someone else can follow the calculation. The next question is whether those times now fit the other evidence of what Jane did.
