Again it depends on a variety of factors such as how long the forgery was in effect. If just for a few minutes, it may be more difficult to detect. A computer forensics examiner can correlate computer logs to check for time anomalies. The time change itself may be logged if the proper computer settings are in place. If the computer is part of a domain with time synchronization in place, the examiner may recover error messages generated as the system tries to correct for the forged time.