• Flashpost: Google Plus Artefacts – URL Forwarding

    Posted on July 5, 2011 by Lee Whitfield in Technical Articles.

    While using Google Plus I noticed this and thought that it may be of use to some of you:

    Whenever you click on a link in G+ you are redirected to a URL that looks like this:

    http://www.google.com/url?sa=z&n=1309767169313&url=http%3A%2F%2Fdilbert.com%2Fstrips%2Fcomic%2F2009-10-04%2F&usg=EazZfazk8jxAKAEECZZ_4OneRqs.

    You are then quickly redirected to the linked site.

    Obviously you can see the original link URL (the Dilbert one) but you’ll also see a Unix time stamp in the URL “1309767169313”. This is the date and time (in GMT) that you clicked on the link, not the date and time that the link was posted. This is also saved in the history of your browser.

    This could add value to forensic investigations. That is, until Google changes it.

    UPDATE

    The time stamp is generate server side. This means it is another way to detect BIOS clock changes. Suh-weet!

One Responseso far.

  1. User says:

    Great job.

Leave a Reply

Your email address will not be published. Required fields are marked *