On Thu, 13 Apr 2006 10:12:14 BST, Eggleston Scott said:
> Microsoft Mail Internet Headers Version 2.0
> Received: from XXXXXXXX ([XXXXXXXX]) by XXXXXXXX with Microsoft
> SMTPSVC(XXXXXXXXX);
> 	 Fri, 3 Mar 2006 19:07:59 +0000

> 	 Fri, 3 Mar 2006 19:08:06 +0000

> 	 Fri, 3 Mar 2006 19:17:18 +0000
> Date:         Wed, 1 Mar 2006 13:37:38 +0000

Well... it looks like somebody sat on it for almost 6 hours (13:37 to 19:17).

In addition, the machines need their clocks synched - the second machine's
clock is at least 7 seconds ahead of the firsts, and the third machine is almost
10 minutes out of sync. This makes figuring out who did what when a lot harder.

(It's OK - I once did forensics on a breakin, and we discovered that one
computer was 17 minutes behind all the others.  So we went nuts adding and
subtracting 17 minutes all the time when correlating logs, and sometimes getting
it wrong and wondering where 34 minutes went... and then one of the guys on the
CIRT said "why does this one say Tuesday and this one Wednesday"?  Turns out that
the offending box was actually 364 days, 23 hours, and 43 minutes off.... ;)