Flashpost: Google Plus Artefacts – URL Forwarding

While using Google Plus I noticed this and thought that it may be of use to some of you:

Whenever you click on a link in G+ you are redirected to a URL that looks like this:

http://www.google.com/url?sa=z&n=1309767169313&url=http%3A%2F%2Fdilbert.com%2Fstrips%2Fcomic%2F2009-10-04%2F&usg=EazZfazk8jxAKAEECZZ_4OneRqs.

You are then quickly redirected to the linked site.

Obviously you can see the original link URL (the Dilbert one) but you’ll also see a Unix time stamp in the URL “1309767169313”. This is the date and time (in GMT) that you clicked on the link, not the date and time that the link was posted. This is also saved in the history of your browser.

This could add value to forensic investigations. That is, until Google changes it.

UPDATE

The time stamp is generate server side. This means it is another way to detect BIOS clock changes. Suh-weet!