role of timestamps in criminal investigations