Time synchronization in logs supports legal investigations by ensuring what?

• A. Better compression of log files.
• B. Reduced disk usage by timestamps.
• C. Automated log rotation.
• D. Accurate timestamps for event correlation and evidence in investigations.

Answer: (D)

Time synchronization across systems gives you a consistent time reference for every log entry, so events from different machines can be lined up accurately. This makes it possible to determine the true sequence of actions, correlate related events, and reconstruct a reliable timeline of an incident. In legal investigations, having precise, synchronized timestamps supports the credibility and integrity of the evidence, helps satisfy chain-of-custody requirements, and enables coordinated analysis across systems. It’s not about log compression or reducing disk usage, and automated log rotation is a separate process tied to log management criteria rather than time accuracy.