时间证据是破获案件的关键,也是计算机取证工作的基础部分。在计算机取证中时间证据的搜集方法是否正确和分析结果是否精确,决定了证据能否被采信以及是否能够证明待证事实。在司法实践中取证调查人员不仅要熟悉计算机系统中的时间信息、文件时间属性,还要掌握时间证据的取证方法和分析方法。 Temporal evidence is the key to breaking a case and a fundamental part of computer forensics. The correctness of the method of collecting time evidence in computer forensics and the accuracy of the results of the analysis determine whether the evidence can be adopted and whether the evidence to be proved can be proved. In judicial practice, forensics investigators should not only be familiar with the time information in computer systems, the time attributes of documents, but also acquire the evidence collection methods and analysis methods of time evidence.