Notes:
When performing forensics it is always a good idea to verify the givens (even for a machine you own).
Accurate timekeeping is very important for forensics. Cannot perform event correllation between systems without it.
