While using Google Plus I noticed this and thought that it may be of use to some of you:
Whenever you click on a link in G+ you are redirected to a URL that looks like this:
http://www.google.com/url?sa=z&n=130976716931
You are then quickly redirected to the linked site.
Obviously you can see the original link URL (the Dilbert one) but you’ll also see a Unix time stamp in the URL “1309767169313”. This is the date and time (in GMT) that you clicked on the link, not the date and time that the link was posted. This is also saved in the history of your browser.
This could add value to forensic investigations. That is, until Google changes it.
UPDATE
The time stamp is generate server side. This means it is another way to detect BIOS clock changes. Suh-weet!
One response to “Flashpost: Google Plus Artefacts – URL Forwarding”
Great job.